Assuming all the steps in the article are followed, yes, you are correct.
I still think any article talking about verifying credentials is obligated to mention that string comparison could be an attack vector.
Like I said, it plants a seed. And, I've seen way too many naive implementations where it is needed (like simple token-based auth systems) to know that this seed needs to be spread a lot more.
I still think any article talking about verifying credentials is obligated to mention that string comparison could be an attack vector.
Like I said, it plants a seed. And, I've seen way too many naive implementations where it is needed (like simple token-based auth systems) to know that this seed needs to be spread a lot more.