Fixed #36901 -- Centralized auth timing attack mitigations.

Thank you Mar Bartolome and Tim Schilling for reviews.

1 files changed, 19 insertions, 0 deletions

diff --git a/django/contrib/auth/__init__.py b/django/contrib/auth/__init__.py
index 21e6dc43d6..aa56df9a3a 100644
--- a/django/contrib/auth/__init__.py
+++ b/django/contrib/auth/__init__.py
@@ -391,3 +391,22 @@ async def aupdate_session_auth_hash(request, user):
     await request.session.acycle_key()
     if hasattr(user, "get_session_auth_hash") and await request.auser() == user:
         await request.session.aset(HASH_SESSION_KEY, user.get_session_auth_hash())
+
+
+def check_password_with_timing_attack_mitigation(user, password):
+    """
+    Checks password against the user's hash if there is a user, otherwise runs
+    the default password hasher to prevent user enumeration attacks (#20760).
+    """
+    if user is None:
+        get_user_model()().set_password(password)
+    else:
+        return user.check_password(password)
+
+
+async def acheck_password_with_timing_attack_mitigation(user, password):
+    """See check_user_with_timing_attack_mitigation."""
+    if user is None:
+        get_user_model()().set_password(password)
+    else:
+        return await user.acheck_password(password)