Documentation
¶
Overview ¶
Package auth holds password hashing, session tokens and login rate limiting.
Index ¶
- Constants
- Variables
- func BurnPasswordCheck(password string)
- func CheckTOTP(secret []byte, code string, now time.Time, lastStep int64) (step int64, ok bool)
- func HashPassword(password string) (string, error)
- func HashRecoveryCode(code string) []byte
- func HashToken(token string) []byte
- func IsLegacyHash(h string) bool
- func NeedsRehash(h string) bool
- func NewRecoveryCodes(n int) (codes []string, hashes [][]byte)
- func NewTOTPSecret() []byte
- func NewToken() (token string, hash []byte, err error)
- func RehashPassword(password string) (string, error)
- func TOTPCodeForTest(secret []byte, step int64) string
- func TOTPSecretText(secret []byte) string
- func TOTPURI(secret []byte, issuer, account string) string
- func VerifyPassword(encoded, password string) (bool, error)
- type Limiter
Constants ¶
const ( MinPasswordLen = 10 MaxPasswordLen = 256 )
Password length limits. The maximum bounds hashing cost for hostile input.
Variables ¶
var ErrPasswordLength = fmt.Errorf("password must be %d to %d characters", MinPasswordLen, MaxPasswordLen)
ErrPasswordLength is returned for passwords outside [MinPasswordLen, MaxPasswordLen].
Functions ¶
func BurnPasswordCheck ¶
func BurnPasswordCheck(password string)
BurnPasswordCheck spends the same time as a real VerifyPassword call.
func CheckTOTP ¶
CheckTOTP verifies a code at time now. It returns the matched time step, which must be greater than the last accepted one so a code cannot be used twice.
func HashPassword ¶
HashPassword returns an encoded Argon2id hash in the PHC string format: $argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>
func HashRecoveryCode ¶
HashRecoveryCode normalises and hashes a recovery code.
func IsLegacyHash ¶
IsLegacyHash reports whether a hash comes from another system (imported bcrypt).
func NeedsRehash ¶
NeedsRehash reports whether a verified hash should be replaced with a current Argon2id one.
func NewRecoveryCodes ¶
NewRecoveryCodes returns n codes like "a1b2c-d3e4f" and their hashes for storage.
func NewToken ¶
NewToken returns a random session token (for the cookie) and its SHA-256 (for the database).
func RehashPassword ¶
RehashPassword re-encodes a password that was just verified against a legacy hash. It does not apply the length rule: imported accounts keep the password they chose elsewhere.
func TOTPCodeForTest ¶
TOTPCodeForTest exposes the code for a time step to tests in other packages.
func TOTPSecretText ¶
TOTPSecretText is the secret as users type it into an app (base32).
func VerifyPassword ¶
VerifyPassword reports whether password matches the encoded hash. Besides Argon2id it accepts bcrypt hashes ($2a$/$2b$/$2y$) imported from Pterodactyl, Paymenter or WHMCS; NeedsRehash tells the caller to replace those after a successful login.
Types ¶
type Limiter ¶
type Limiter struct {
// contains filtered or unexported fields
}
Limiter counts failed attempts per key in a fixed window (in memory, per panel process). It is used to slow down password guessing against one account or from one address.
func NewLimiter ¶
NewLimiter allows max failures per key within window.
Source Files