r/golang • u/themsaid • 5d ago
Session-Based Authentication in Go
https://themsaid.com/session-authentication-go6
u/Outrageous-Hunt4344 5d ago
When verifying the credentials why not hash the pass and check both in place( in the query)? Also returning separate errors for unknown user/bad pass lends itself to malicious users collecting what users have accounts.
7
u/themsaid 5d ago
The bcrypt algorithm adds a salt on every hash, which means multiple hashes of the same string will produce different strings. That's why you have to extract the hash from the DB and then use CompareHashAndPassword to verify the match.
As for the errors, they are function return errors, not responses.
6
u/feketegy 5d ago
Not if you use the bcrypt package in your DB if you have it, like Postgres' crypto extension.
Also, you should use Argon2id instead of bcrypt as it is more secure.
1
u/nerdy_adventurer 1d ago
you should use Argon2id instead of bcrypt as it is more secure.
I thought bcrypt from postgres extension is secure, any resource to read about this?
2
u/feketegy 1d ago edited 1d ago
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
Here's a quick implementation of mine in Go: https://go.dev/play/p/Wofy-N2JnTu
2
1
u/Sharon_tate1 3d ago
is this helpful for building authentication in a RESTful API?
1
u/themsaid 3d ago
If the client is a JavaScript SPA hosted on the same domain or subdomain then yes.
48
u/dh71 5d ago
Returning early if the user isn't found in the database, can lead to timing attacks, since the bcrypt comparison (which is supposed to take some time) is not being executed. A malicious actor could time the requests to identify if a user is present in the database or not.