Prevent timing attack

8961f60effc7-user-noverify.ex

@doc """
Verifies the password.
 
If there is no user or the user doesn't have a password, we call
`Bcrypt.no_user_verify/0` to avoid timing attacks.
"""
def valid_password?(%TestAuth.Accounts.User{hashed_password: hashed_password}, password)
    when is_binary(hashed_password) and byte_size(password) > 0 do
  Bcrypt.verify_pass(password, hashed_password)
end
 
def valid_password?(_, _) do
  Bcrypt.no_user_verify()
  false
end