Function: verifyDummyTOTP()

verifyDummyTOTP(token): Promise<void>

Defined in: src/auth/shared.ts:736

Performs a TOTP verification against a fixed dummy secret, discarding the result. Used to equalize the response time of a "user/secret not found" path with a "secret found, code checked" path so that an attacker can't enumerate valid accounts by measuring response latency.

Parameters

token

string

The value to verify against the dummy secret. Never actually a real code of anyone.

Returns

Promise<void>