fix(authn): apply fail delay only if credentials/sessions are supplied (

#1920) Signed-off-by: Petu Eusebiu <[email protected]>
project-zot · Oct 12, 2023 · d1fcab4 · d1fcab4
1 parent ab45356
commit d1fcab4
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/pkg/api/authn.go b/pkg/api/authn.go
@@ -675,7 +675,9 @@ func getRelyingPartyArgs(cfg *config.Config, provider string) (
 }
 
 func authFail(w http.ResponseWriter, r *http.Request, realm string, delay int) {
-	time.Sleep(time.Duration(delay) * time.Second)
+	if !isAuthorizationHeaderEmpty(r) || hasSessionHeader(r) {
+		time.Sleep(time.Duration(delay) * time.Second)
+	}
 
 	// don't send auth headers if request is coming from UI
 	if r.Header.Get(constants.SessionClientHeaderName) != constants.SessionClientHeaderValue {