fix(auth): bind request auth snapshots

tools/tht/internal/authconfig/password.go

@@ -20,7 +20,7 @@ const (
 	argon2SaltBytes        = 16
 	argon2KeyBytes  uint32 = 32
 
-	maximumPHCBytes               = 256
+	maximumPHCBytes = 256
 )
 
 type argon2Parameters struct {
@@ -130,8 +130,9 @@ func decodePHCBase64(value string, minimum, maximum int) ([]byte, bool) {
 	if value == "" || strings.ContainsRune(value, '=') || len(value) > base64.RawStdEncoding.EncodedLen(maximum) || len(value) < base64.RawStdEncoding.EncodedLen(minimum)-1 {
 		return nil, false
 	}
-	decoded, err := base64.RawStdEncoding.DecodeString(value)
-	if err != nil || len(decoded) < minimum || len(decoded) > maximum {
+	encoding := base64.RawStdEncoding.Strict()
+	decoded, err := encoding.DecodeString(value)
+	if err != nil || len(decoded) < minimum || len(decoded) > maximum || encoding.EncodeToString(decoded) != value {
 		return nil, false
 	}
 	return decoded, true