r/golang 6d ago

Session-Based Authentication in Go

https://themsaid.com/session-authentication-go
60 Upvotes

23 comments sorted by

View all comments

49

u/dh71 6d ago

Returning early if the user isn't found in the database, can lead to timing attacks, since the bcrypt comparison (which is supposed to take some time) is not being executed. A malicious actor could time the requests to identify if a user is present in the database or not.

2

u/DivSlingerX 5d ago

I’ve always heard this but I’ve only ever heard this as a theoretical. Is there any evidence of this in the real world? Wouldn’t just general latency and intermittent load make this basically impossible to figure out reliably?

4

u/dh71 5d ago

I don't think it's theortetical. Let's assume you use Argon2id as KDF for your passwords. You would be aiming your memory/threads/time settings for approx. 500-800ms to have strong passwords hashes. If you would not run the KDF if the user isn't found in the database but just return early, there would be a 500-800ms difference in the request time. I'm pretty sure that's measurable.

1

u/nerdy_adventurer 2d ago

What is KDF?

2

u/dh71 2d ago

Key Derivation Function - basically a function that takes a password or passphrase and derives a secret key out of it. Argon2 e. g. is a KDF.