autocert VS uuid

Pull request link

The version in the Golang stdlib is a pure-go implementation, but there's an assembler variant optimized for amd64 (https://github.com/golang/crypto/blob/master/sha3/keccakf_am...), which is apparently derived from the XKCP package.

Bad news for the (mostly-Golang) Ethereum ecosystem...

Learn crypto library and how to encrypt and hash: https://github.com/golang/crypto

In last section we have created users table in our database, but we are currently storing user's password in plain text. This is something we should never do, and instead we need to store hashed password with random salt. For that we will use golang/crypto library. First we need to expand our User structure:

So in conclusion, croc seems to be pretty secure as long as you use P-256 (or P-384). Internally, the standard golang.org/x/crypto library is used, which I can guarantee is very secure, as it is used in millions of web servers around the world, and Go is a language maintained by Google, which has many security professionals at their disposal. Ultimately, the decision is yours. While I can give you my opinion and point you to correct documents, you should trust nobody other than yourself. Not even me. But still, I recommend P-256 above everything else.

I've been considering developing suck tools with Golang. Golang's crypto package golang crypto might be a great starting point if your familiar with language.

https://github.com/golang/crypto/blob/eec23a3978adcfd26c29f4153eaa3e3d9b2cc53a/bcrypt/bcrypt.go#L234-L254

I use Google's UUID package a lot. But every time I refer to it in a new package, the language server picks up https://github.com/gofrs/uuid instead of https://github.com/google/uuid and then complains that the gofrs package isn't in go.mod. I assume because it's the first alphabetically (though this seems like a huge supply chain security loophole).

Just store one single UUID as a token in a client's cookie (use https://github.com/google/uuid for ex), and associate that to a user ID (or anything else relevant in your case), and an expiry date for example

Depends on your needs I think, I generally just use github.com/google/uuid like /u/wowsux mentioned it supports v1 through v5 of the UUID spec.

And we are also going to use google/uuid to generate random uuids.

If you are using "github.com/google/uuid", try the following codes

You can see the same naming dilemma in many Go library implementations, i.e., where a package is used to organize functions related to a single a type (https://github.com/google/uuid) vs organizing code of related functionality (https://github.com/golang/go/tree/master/src/math).

Type inference is not perfect yet (especially for functional options). Also not being able to add type parameters to methods is a bit annoying (can be worked around using package-level functions) but besides that generics fit quite nicely into the library. If type inference gets better then I think I can even remove the hard dependency on github.com/google/uuid and let users use custom types for ids.

Learn how to create UUIDs: https://github.com/google/uuid