From d1fcab421abdd96fc7d19f5586b694670051ee7a Mon Sep 17 00:00:00 2001
From: peusebiu <peusebiu@cisco.com>
Date: Thu, 12 Oct 2023 16:32:36 +0300
Subject: [PATCH] fix(authn): apply fail delay only if credentials/sessions are
 supplied (#1920)

Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>
---
 pkg/api/authn.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkg/api/authn.go b/pkg/api/authn.go
index f146ec165..741db65b7 100644
--- a/pkg/api/authn.go
+++ b/pkg/api/authn.go
@@ -675,7 +675,9 @@ func getRelyingPartyArgs(cfg *config.Config, provider string) (
 }
 
 func authFail(w http.ResponseWriter, r *http.Request, realm string, delay int) {
-	time.Sleep(time.Duration(delay) * time.Second)
+	if !isAuthorizationHeaderEmpty(r) || hasSessionHeader(r) {
+		time.Sleep(time.Duration(delay) * time.Second)
+	}
 
 	// don't send auth headers if request is coming from UI
 	if r.Header.Get(constants.SessionClientHeaderName) != constants.SessionClientHeaderValue {