Function: verifyDummyPassword()

verifyDummyPassword(password): Promise<void>

Defined in: src/auth/shared.ts:820

Performs an Argon2 verification against a fixed dummy hash, discarding the result. Used to equalize the response time of a "user not found" path with a "user found, password checked" path so that an attacker can't enumerate valid usernames/emails by measuring response latency (a nonexistent user would otherwise short-circuit before ever running the deliberately-slow Argon2 verify).

Parameters

password

string

The value to verify against the dummy hash. Never actually a real password of anyone.

Returns

Promise<void>