hello, I found 1 time sleep below which I don't know why we need it, can someone explain? Thanks so much. selfservice/strategy/password/login.go

i, c, err := s.d.PrivilegedIdentityPool().FindByCredentialsIdentifier(r.Context(), s.ID(), p.Identifier)
    if err != nil {
        time.Sleep(x.RandomDelay(s.d.Config(r.Context()).HasherArgon2().ExpectedDuration, s.d.Config(r.Context()).HasherArgon2().ExpectedDeviation))
        return nil, s.handleLoginError(w, r, f, &p, errors.WithStack(schema.NewInvalidCredentialsError()))
    }

Maybe @User can answer that question? I am not sure.

the problem here is that it would allow for side-channel attacks by figuring out if the account exists based on response time

Ah, got it, thank @User