Function compareHashAndPassword

auth/password_hash.go:42–56

compareHashAndPassword is an optimized wrapper around bcrypt.CompareHashAndPassword that caches successful results in memory to avoid the _very_ high overhead of calling bcrypt.

(cache Cache, hash []byte, password []byte)

// compareHashAndPassword is an optimized wrapper around bcrypt.CompareHashAndPassword that
// caches successful results in memory to avoid the _very_ high overhead of calling bcrypt.
func compareHashAndPassword(cache Cache, hash []byte, password []byte) bool {
	// Actually we cache the SHA1 digest of the password to avoid keeping passwords in RAM.
	key := authKey(hash, password)
	if cache.Contains(key) {
		return true
	}
	// Cache missed; now we make the very slow (~100ms) bcrypt call:
	if err := bcrypt.CompareHashAndPassword(hash, password); err != nil {
		// Note: It's important to only cache successful matches, not failures.
		// Failure is supposed to be slow, to make online attacks impractical.
		return false
	}
	cache.Put(key)
	return true
}

// SetBcryptCost will set the bcrypt cost for Sync Gateway to use
// Values of zero or less will use bcryptDefaultCost instead