fix(authn): apply fail delay only if credentials/sessions are supplied

Signed-off-by: Petu Eusebiu <[email protected]>
project-zot · Oct 10, 2023 · 9ad2843 · 9ad2843
1 parent 039648a
commit 9ad2843
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/pkg/api/authn.go b/pkg/api/authn.go
@@ -675,7 +675,9 @@ func getRelyingPartyArgs(cfg *config.Config, provider string) (
 }
 
 func authFail(w http.ResponseWriter, r *http.Request, realm string, delay int) {
-	time.Sleep(time.Duration(delay) * time.Second)
+	if !isAuthorizationHeaderEmpty(r) || !hasSessionHeader(r) {
+		time.Sleep(time.Duration(delay) * time.Second)
+	}
 
 	// don't send auth headers if request is coming from UI
 	if r.Header.Get(constants.SessionClientHeaderName) != constants.SessionClientHeaderValue {