Email Login

GO Shortener provides a fully self-contained, native email and password authentication system that requires no third-party identity providers to function.

Password Hashing & Storage

When a user registers or updates their password, GO never stores plaintext credentials.

• Salting: bcrypt automatically generates a cryptographically unique 128-bit salt for every password before hashing, effectively neutralizing precomputed rainbow table attacks.
• Work Factor 12: Balances verification speed against brute-force resilience, requiring significant CPU cycles to attempt offline dictionary attacks.
• Password Requirements: Enforces minimum length (8+ characters) and basic complexity validation on the frontend and backend.

Session Architecture

Upon successful authentication, the server establishes a stateful or signed session:

The go_session Cookie

The authentication token is transmitted to the client in an HTTP cookie named go_session configured with strict security flags:

• HttpOnly: Prevents client-side JavaScript (e.g., XSS attacks) from reading or manipulating the session token.
• SameSite=Lax: Defends against Cross-Site Request Forgery (CSRF) by ensuring cookies are not sent on cross-site subrequests.
• Secure: Automatically enforced in production environments when requests are routed through HTTPS / Cloudflare Tunnel.
• Path=/: Grants session validity across all API and web routes.

Session Lifetime

The validity duration of session cookies is configured via the .env variable:

SESSION_DURATION_HOURS=72

When a user logs out via the user menu or POST /api/auth/logout, the server expires the go_session cookie immediately.