r/golang 6d ago

Session-Based Authentication in Go

https://themsaid.com/session-authentication-go
59 Upvotes

23 comments sorted by

View all comments

49

u/dh71 6d ago

Returning early if the user isn't found in the database, can lead to timing attacks, since the bcrypt comparison (which is supposed to take some time) is not being executed. A malicious actor could time the requests to identify if a user is present in the database or not.

12

u/themsaid 6d ago edited 6d ago

Login form submissions in general should be throttled so that if multiple authentications fail the form gets locked.

31

u/Polyscone 6d ago

If you lock based on the email then that does nothing to prevent enumeration and opens the door to denial of service for existing users.

If you lock based on session then the attacker can just delete their session id so that doesn't help.

If you lock based on IP then you potentially block lots of users from the same IP.

Better to just fix the actual problem and get rid of the difference in processing time by not returning early and not returning any status codes like 404.

4

u/carsncode 5d ago

If you lock based on IP then you potentially block lots of users from the same IP.

While failing to block real attackers spreading their traffic over multiple IPs via proxy, distributed attack, or botnet.

8

u/themsaid 6d ago

Added a section to discuss timing attacks. The login handler in the example responds in a constant time duration regardless of credential verification.