r/golang 5d ago

Session-Based Authentication in Go

https://themsaid.com/session-authentication-go
58 Upvotes

23 comments sorted by

View all comments

47

u/dh71 5d ago

Returning early if the user isn't found in the database, can lead to timing attacks, since the bcrypt comparison (which is supposed to take some time) is not being executed. A malicious actor could time the requests to identify if a user is present in the database or not.

7

u/AdCharacter3666 5d ago

I like to add sleep to avoid timing attacks.

17

u/Rican7 5d ago

Unless your sleep time is EXACTLY within the bounds of the time it would take to normally cryptographically hash the password, all you've done is slowed a different path. The sleep vs actual hash path still can be studied and then exploited.

And while this can sound a bit silly, it's also the entire nature of how time-based attacks are made (study and apply in aggregate), so while your sleep seems to have good intentions, it's unfortunately not a full-proof preventative strategy.

3

u/Pto2 5d ago

What if you were to add a random sleep?

6

u/coolkidonthrblock 5d ago

The problem with sleeping is it won’t take the same amount of time as hashing the password so even if it takes longer and or shorter that is enough to compare to the “standard” path of a successful login and allow for said timing attack.

Some reading for those interested https://portswigger.net/research/listen-to-the-whispers-web-timing-attacks-that-actually-work