Document Timing Attack Mitigation Support

Open Beginner friendly
#19,082 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Quiet
Tech stack
java, spring
Domain
authentication, documentation, security

Research direction

Start by reading the two linked reference pages: the DAO authentication provider page and the exploits page. Document the timing-attack mitigation, its use of the configured password encoder, and the limitation when multiple password-hash types are present; done means both pages explain the behavior and the recommended password upgrade path.

Written by the indexing model from the issue text.

Description

in: docs type: enhancement

DaoAuthenticationProvider protects against timing attacks by encoding an internally-generated password in lieu of the user's password when the user is not found, allowing both found and not-found paths to take approximately the same time.

It would be nice to have this noted in https://docs.spring.io/spring-security/reference/servlet/authentication/passwords/dao-authentication-provider.html and explained in https://docs.spring.io/spring-security/reference/servlet/exploits/index.html.

Some notes about it to consider:

  • DaoAuhenticationProvider uses whatever password encoder that the website uses for users, giving a srong guarantee that the not-found and found paths will take the same order-of-magnitude time to execute
  • There are limits to when this same timing is plausible, though. For example, a database that has more than one kind of password hash in it, Spring Security cannot anticipate how long to take in the not-found scenario since there are multiple found scenarios that take orders of magnitude different amounts of time. The best defense here is to upgrade your users passwords to a modern password algorithm.
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from spring-projects/spring-security

All issues in spring-projects/spring-security

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.