Replace all MD5 Password Hashing w/ bcrypt

Author: elithrarCreated Aug 15, 2014Updated Jan 14, 2024

MD5 hashes are easily brute forced (or bypassed with a rainbow table) - especially so when unsalted.

I strongly suggest changing your Custom Authentication example to use Go's bcrypt package, which is both simple to use and extremely secure.

The login code would therefore become:

err := bcrypt.CompareHashAndPassword(userInfo.Password, []byte(password))
if err != nil {
    this.Data["PasswordErr"] = "Password error, please try again"
    return
}

... and in the registration process:


// After checkPassword(password)

hash, err := bcrypt.GenerateFromPassword([]byte(password))
if err != nil {
    this.Data["PasswordErr"] = "Password error, please try again"
    return
}

...

users.Password = hash

For further reading: http://yorickpeterse.com/articles/use-bcrypt-fool/

Source: astaxie/build-web-application-with-golang

View original on GitHub View discussion on GitHub