Every time I write login, I do one small thing on line 122 that looks completely pointless.
If the email isn't in the database, I still run a bcrypt compare against a dummy hash before I return. Why would you hash a password for a user that doesn't exist?
Because of timing. If you return early the moment the user is missing, that path is fast. The path where the user does exist is slow, because bcrypt is slow on purpose. An attacker times your responses and now knows which emails are registered. That's user enumeration.
So I make both paths cost about the same. User exists or not, the response comes back in roughly the same time. Nothing leaks.
Small detail, big difference. Detailed video on this coming soon, stay tuned.