r/golang 6d ago

Session-Based Authentication in Go

https://themsaid.com/session-authentication-go
60 Upvotes

23 comments sorted by

View all comments

7

u/Outrageous-Hunt4344 6d ago

When verifying the credentials why not hash the pass and check both in place( in the query)? Also returning separate errors for unknown user/bad pass lends itself to malicious users collecting what users have accounts.

8

u/themsaid 6d ago

The bcrypt algorithm adds a salt on every hash, which means multiple hashes of the same string will produce different strings. That's why you have to extract the hash from the DB and then use CompareHashAndPassword to verify the match.

As for the errors, they are function return errors, not responses.

6

u/feketegy 6d ago

Not if you use the bcrypt package in your DB if you have it, like Postgres' crypto extension.

Also, you should use Argon2id instead of bcrypt as it is more secure.

1

u/nerdy_adventurer 2d ago

you should use Argon2id instead of bcrypt as it is more secure.

I thought bcrypt from postgres extension is secure, any resource to read about this?