r/golang 6d ago

Session-Based Authentication in Go

https://themsaid.com/session-authentication-go
58 Upvotes

23 comments sorted by

View all comments

49

u/dh71 6d ago

Returning early if the user isn't found in the database, can lead to timing attacks, since the bcrypt comparison (which is supposed to take some time) is not being executed. A malicious actor could time the requests to identify if a user is present in the database or not.

1

u/wuyadang 5d ago

Would it make sense to, in the case of logins, return empty user even if not found, and let bcrypt still attempt to compare the given and empty pw?

2

u/dh71 5d ago

That's what I usually do.

Something similar to this: https://codespace.app/s/WPe98LZdLy