5 ms·

I really like this book, but what I found most difficult when implementing a website is the authentication part. How password should be encrypted? How session

• stewie2 14y ago
  And also caching, that is an important topic.
• dchest 14y ago
  I understand that your comment is about this book, but I'll go ahead and answer your questions with links to packages (plus I get a chance to plug a few of my own creation :). If you want to learn how they work, reading docs and code is the best exercise. It's not a substitute for the proper book, though, but may turn out to be useful. How password should be encrypted? Choose your package: go get github.com/dchest/scrypt go get code.google.com/p/go.crypto/bcrypt go get code.google.com/p/go.crypto/pbkdf2 How session id should be generated and passed to the user? If you mean how you can authenticate logged in users, then you can use this package: go get github.com/dchest/authcookie How session information should be saved? (cookie? file? database? memory?) Up to you, but generally it's better to avoid cookies for storing anything other than IDs. There are a few packages for "sessions" like in PHP, but I don't remember their names. One more important question to add: How do I protect against XSRF attacks? go get code.google.com/p/xsrftoken You can read documentation for these packages here: http://go.pkgdoc.org/ http://go.pkgdoc.org/ As for HTTPS, it's a complicated thing. Pick any good book on it, then apply your knowledge to the standard package crypto/tls (http://golang.org/pkg/crypto/tls/ http://golang.org/pkg/crypto/tls/).
  • stewie2 14y ago
    Wow, Thank you very much!
• swdunlop 14y ago
  https is quite straightforwards in Go; the most direct means [1] essentially adds two parameters to http.ListenAndServe to supply paths to your cert and key file. The more flexible indirect ones involve either providing a TLS config [2] or using the crypto/tls package to create a TLS listener [3]. It comes down to which abstraction level works for your configuration. Due to Go's pervasive use of io.Writer / io.Reader / net.Conn interfaces, once you have the problem of loading keys sorted, everything else is the same as writing a plain old TCP/IP listener. Configuring TLS will always be a pain -- decades, committees and broken implementations have seen to that. As for actually verifying passwords and session integrity, Go's crypto packages are also pretty straightforwards and composable. The crypto/hmac [4] package is easily combined with various implementations of hash.Hash. In exchange for this simplicity, though, Go gives you plenty of opportunity to emulate LinkedIn and blow your own foot off, forgetting salt and common sense. There are plenty of higher level packages that offer to do it for you. (Blow your foot off, or hash your passwords -- I recommend reading implementations to decide which. :)) Also of interest when dealing with writing webapps in Go, the database/sql [5] package is an important abstraction. Since it is a more recent package, it often doesn't show up in google searches for sqlite, postgres, etc. This can give an impression that Go's database support is fragmented. 1 -- http://golang.org/pkg/net/http/#ListenAndServeTLS http://golang.org/pkg/net/http/#ListenAndServeTLS 2 -- http://golang.org/pkg/net/http/#Transport http://golang.org/pkg/net/http/#Transport 3 -- http://golang.org/pkg/crypto/tls/#Listener http://golang.org/pkg/crypto/tls/#Listener 4 -- http://golang.org/pkg/crypto/hmac http://golang.org/pkg/crypto/hmac 5 -- http://golang.org/pkg/database/sql http://golang.org/pkg/database/sql
  • stewie2 14y ago
    Thank you very much for the answers!