Go tutorial Part 11 (Web app Part 9)

Key Takeaways

hi guys welcome to go tutorial part 11 my name is tensor from the tensor programming blog and today we're just going to do a rather quick tutorial and we're going to implement a method to hash our password using bcrypt and we are also going to create our unique user ID for our table first before we start coding let's go over what exactly these two things are so our universal unique identifier is basically just going to look like this so as you can see there's eight characters here then 4 then 4 then 4 and then 2012 and these are all generated by random numbers then for bcrypt bcrypt is basically just a hashing function that was created back in 99 and it's pretty much the default hashing algorithm used on many of the Linux distributions and it's pretty it's a very strong way of actually encrypting a password so currently if we look at our data inside of our SQL file you'll see here that our password is in plain text this is not something that we want generally when you create a web app that has user validation you want the users to be able to sign in and you want to be able to store their passwords but you never want to be able to store their passwords in plain text because first of all would be insecure because anybody who had had admin access would be able to just break into your SQL database and you know access anybody else's account but also because it would be very easy for somebody to hack and so if somebody tries to hack this particular database as it is currently all they have to do is guess what the white password is whereas if we encrypt it with bcrypt then they have to guess both the password and the salt that we use to hash the actual password ok so let's get started so let's actually integrate the bcrypt right now so go has its own bcrypt library it's not a standard library but it is pretty well used library so let's import it the library that we're going to need is going down orb backslash expec slash crypto backslash bcrypt and this is going to allow us to encrypt our password so we're going to create a function and let's call it encrypt pass and we're gonna pass in our password which would be a type string of course and then we are going to pass back a string sorry encrypt password is going to be rather easy so we're going to bring in our password and then we are going to convert it to a byte or rather a slice of bytes so we will say pass equals slice of bytes password hashing so there is a function in our bcrypt that allows us to simply just hash our password so we will say hash PW comma underscore and equals and let's call our library bcrypt and then the function is called generate from password and in here we enter in our password and then we enter in the cost which is basically the amount of computational power that we want to encrypt this particular password with so in this case we're just going to use the default cost which is actually just 10 so I can just put in 10 and it will work but I'd rather just actually bring in our default cost so bcrypt default cost so now we have our hash password and we just need to return it as a string because it's a slice of ice so now we will actually encrypt the password and it will return it as a string so we have this user exists' function up here and this what this does is it queries the database for the username and password where the username and password equal with such-and-such so we need to amend it and this will allow us to validate the user based on the hashed password so the way we amend it is we come down here between where we scan our password and where we actually check if the password equals the password that we're bringing in from the user instance and we say password equal be crypts and Paran hash password and then we're gonna pass in a slice of bytes for our password which is the one that's being brought out of the SQLite database and then we are going to pass in our Utah password which is the password that's being passed through the form for validation so what this will do is it will compare the two you know compare our password say it's just password or our one two three four five six with the hashed version of one two three four five six and it will either send back nil if they are actually equal or it will send back an error if they aren't so we can come here instead of saying PS equals Utah password we can say P W equals nil so if this comes back as no that means that they're both equal and so we want to return true which means our user exists in the database we also want to amend this here because the way that we're searching for our username and password is we are actually searching for a username with this username so the instance username and the password with that user password but unfortunately this password is not going to be in our database anymore so if we just remove this part entirely and just search for the username things should work much better so now we can go into our main deco file and we can come down here to our signup function and where we are actually bringing in the password we can just call our function that encrypt it straight from the forum value and what this will do is it will encrypt the password and then when we put it into our database it will be encrypted so at no point in our API where we have the rights password which is nice though if you're going to do things like this if you're working on like say a commercial version I would probably use it in between variable and I call the function directly normally you'd have some kind of error that you'd be passing back from the function as well so generally you wouldn't want to do it like this but because of the way that we're building this user function it shouldn't be a problem okay so now we need to create our unique user ID so if you remember the way the unique user ID works is it is a bunch of random numbers where we have eight numbers in the front then four then 4 then four and then 12 so the way our function is going to work is we're going to input nothing and then we're going to output an ID of string so we want to have a global variable called ID and we're going to say okay be make and we're going to make a array of bytes and this is going to be of 16 of size 16 and the reason why it's going to be of size 16 despite the fact that our actual user ID is of size 32 is because a byte actually is two characters so this actually will work to our advantage so we're only using a size 16 but it will actually look like it's 32 so now we need to generate our random numbers and we're going to use a library that exists in golang so let's actually call ran dot read then we're gonna set and be in there and our library is called crypto r and so here it is crypto brand and this is allowing us to create or to put random numbers into this byte but they're not just random numbers random characters then we need to check our error so we're going to say if error it's not equal now return and this will just quit the function if we have an error otherwise we need to say ID equals fmt dot s print F and this will allow us to format our string for a return and the way we want to format it is we want to put dashes between a certain amount of characters so if you remember what it looked like in the Wikipedia article as you can see there are six characters here and then a dash then 4 then 4 then 4 and then another set of characters so all we really need to do is make it look like this so we're going to say okay so our fur X is going to be be zero to four our second X will be four and six because remember two so this is only two parts of the array but it will be four characters long and as you can see for our next two we also do two characters long so six to eight and then eight to ten and then we do the rest which is ten to sixteen so we just can call ten to the end and this will format it the way that we want so then all we have to do at the end is just hit return and this will return our ID because we have already defined it up here as our return value so now we need to actually edit our save data function here so that it will actually save the unique user ID so we want to set in our unique user ID as a text field and then we want to set it in here as well which means we also need to add another question mark in here and then we want to call it in our exec function as udu ID so this will work but right now of course we're not actually setting it in through main so we want to actually call UUID and then we're going to call our function UUID so this will generate a unique user ID and set it into this field automatically so we need to delete our database because as it is currently we only have five columns and we just made it so that we have six columns so we could either delete the database or delete the table so let's just delete the table now if we open up the database again it has no table in it so let's run our file real quick and see what happens so here we are at the signup page and let's sign up okay so we'll put in tensor with a capital T and then we'll put in John Doe and we'll put in test at example.com and our password will be one two three four five six we'll hit submit now let's take a look at our SQL write database so inside of our database we have our unique user ID as you can see it's formatted in the way we wanted which is nice we also have our password and as you can see this is not one two three four five six rather this is being completely hashed and in fact to demonstrate my point first let's login but so it's actually checking the one two three four five six with the hashed password if we sign up again let's say tensor to first name John - Doh - and let's give her an email of just test a test comm and say you know let's put in the same password one two three four five six and hit submit if we look at this in the database as you can see here the first team characters are the same so it goes a dollar sign then - way then a dollar sign then 10 then a dollar sign and then from there everything else is completely different but even though these are the same passwords in reality they will actually come back as correct if we try to match them so if I try to sign in as 10 sir - and I just type in 1 2 3 4 5 6 it will still work even though there are two separate hashes so this is kind of cool and as you can see our unique ID has also been updated and it's completely different alright guys so I hope you enjoyed this tutorial in our next tutorial we'll actually start to look at how we can add more user validation to this application and we will look at why we actually created this unique user ID if you enjoyed this video please feel free to like and subscribe if you have any questions of course feel free to comment and if you dislike the video then feel free to download it I hope you guys have a happy new year