Matthew HoltandCopilot a6af063626 caddyauth: cache only successful password comparisons ...

Failed comparisons for missing accounts all used the same fake hash, so
their cached results returned quickly while failures for real accounts
did not, leaking which usernames exist. Cache only successful
comparisons and scope cache keys to the username.

Addresses scan report 430e037dbf6a4fd3.

Code written by GitHub Copilot (GPT-6.1 Sol, Claude Opus 5.5); reviewed by mholt.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-11-11 11:06:40 -07:00

..

caddyevents

events: tell CertMagic which events are worth emitting (#8010)

2026-10-03 01:03:20 +10:00

caddyfs

events: Refactor; move Event into core, so core can emit events (#6930)

2025-03-29 08:15:43 -06:00

caddyhttp

caddyauth: cache only successful password comparisons

2026-11-11 11:06:40 -07:00

caddypki

acmeserver: say when the CA database is locked by another process (#8007)

2026-09-11 14:49:31 +10:00

caddytls

caddytls: require a trust pool for client cert verification modes (#8394)

2026-11-10 09:09:17 +00:00

filestorage

…

internal/network

reverseproxy: reduce lock contention in dynamic SRV and A upstreams (#7949)

2026-11-03 08:37:50 +00:00

logging

logging: Parse request URIs in the query filter like the server does (#8255)

2026-10-19 07:43:29 +00:00

metrics

…

standard

…