4 ms·
:-) put me on the spot! thanks for going through the code though. security layer definitely needs more work. my choices were mostly limited by my haste to get
by wilsonfiifi 13y ago
:-) put me on the spot! thanks for going through the code though.
security layer definitely needs more work. my choices were mostly limited by my haste to get a working prototype and not very well thought through.
- mappu 13y agoNo problem, thanks for sharing your project with everyone! Just people definitely like to use symbols in passwords. Your fundamentals are fine, i don't think those are very serious problems compared to the average custom web app in the wild (most of which probably use plaintext passwords with no concern for sqli or xss...)
- ryalfalpha 13y agoHaven't done much golang and don't have it installed on this laptop, but are string comparisons constant time? If not, I think there is potential for a timing attack here? if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }
- omra 13y agoGo does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.
- wilsonfiifi 13y agoThanks for pointing that out. Will look into it