Documentation
¶
Overview ¶
Package webauth provides password hashing, TOTP, and encryption helpers for web UI login.
Index ¶
- Constants
- func CheckPassword(hash, password string) bool
- func CodeAt(secret string, now time.Time) (string, error)
- func GenerateTOTPSecret() (string, error)
- func HashPassword(password string) (string, error)
- func LooksLikeTOTPCode(code string) bool
- func TOTPProvisioningURI(secret, username, issuer string) string
- func UIDForUsername(username string) string
- func ValidatePasswordStrength(username, password string) error
- func VerifyTOTP(secret, code string, now time.Time) (step int64, ok bool)
- type Encryptor
- func (e *Encryptor) ConsumeBackupCode(hashes []string, code string) (remaining []string, ok bool)
- func (e *Encryptor) Decrypt(ciphertext, nonce []byte) ([]byte, error)
- func (e *Encryptor) Encrypt(plaintext []byte) (ciphertext, nonce []byte, err error)
- func (e *Encryptor) GenerateBackupCodes(n int) (codes, hashes []string, err error)
- func (e *Encryptor) HashBackupCode(code string) string
Constants ¶
const ( // MinPasswordLength is the minimum allowed password length for web accounts. MinPasswordLength = 12 // MinBcryptCost is the minimum accepted bcrypt cost. MinBcryptCost = 10 // BackupCodeCount is how many one-time backup codes are issued at enroll time. BackupCodeCount = 10 // BackupCodeBytes is the entropy used per backup code before encoding. BackupCodeBytes = 5 // PendingSessionTTL is the max lifetime of pending_2fa / pending_enroll cookies. PendingSessionTTL = 5 * time.Minute // FullSessionTTL is the accessToken lifetime after successful 2FA. FullSessionTTL = 24 * time.Hour )
const ( KindPending2FA = "pending_2fa" KindPendingEnroll = "pending_enroll" KindPendingBackupAck = "pending_backup_ack" KindFull = "full" )
Session kinds stored in parameter params["kind"].
const ( CookieAccessToken = "accessToken" CookiePending = "pendingAuth" )
Cookie names for web auth.
Variables ¶
This section is empty.
Functions ¶
func CheckPassword ¶
CheckPassword reports whether password matches hash.
func GenerateTOTPSecret ¶
GenerateTOTPSecret returns a new base32-encoded TOTP secret (20 bytes).
func HashPassword ¶
HashPassword returns a bcrypt hash of password.
func LooksLikeTOTPCode ¶
LooksLikeTOTPCode reports whether code is a 6-digit TOTP shape (not a backup code).
func TOTPProvisioningURI ¶
TOTPProvisioningURI builds an otpauth URI for authenticator apps.
func UIDForUsername ¶
UIDForUsername returns the stable web uid for a username.
func ValidatePasswordStrength ¶
ValidatePasswordStrength rejects short or known-weak passwords.
Types ¶
type Encryptor ¶
type Encryptor struct {
// contains filtered or unexported fields
}
Encryptor holds the AES-256-GCM key used for TOTP secrets and backup-code pepper.
func LoadEncryptor ¶
func LoadEncryptor(encryptionKey, keyDir string) (enc *Encryptor, fromFile, created bool, err error)
LoadEncryptor resolves the encryption key from explicit config or a persistent file. When encryptionKey is empty, a key file is created/read under keyDir (0600) and a warning should be logged by the caller (FromFile reports created=true).
func (*Encryptor) ConsumeBackupCode ¶
ConsumeBackupCode returns updated hashes with matching code removed, or ok=false.
func (*Encryptor) Encrypt ¶
Encrypt encrypts plaintext with AES-256-GCM. Returns ciphertext and nonce.
func (*Encryptor) GenerateBackupCodes ¶
GenerateBackupCodes returns plaintext codes and their hashes.
func (*Encryptor) HashBackupCode ¶
HashBackupCode returns a HMAC-SHA256 hex digest of code using the encryptor key as pepper.
Source Files