> Password must be composed of only alpha-numeric characters.
Okay, why?
This caught my eye so i had a look through auth.go. Passwords are salted sha1... okay, but why not bcrypt? No PBKDF2? No field for hash format versioning if you want to backwards-compatible upgrade to bcrypt in future? Guess you could always go by the salt length or something.
It looks like your code to hash the password and salt is copy-pasted and appears twice, don't do that.
Your salts are 16 random bytes, okay.. but why base64 encode the salt before hashing? Now some structure of the content is known that might expose a weakness.
No problem, thanks for sharing your project with everyone! Just people definitely like to use symbols in passwords.
Your fundamentals are fine, i don't think those are very serious problems compared to the average custom web app in the wild (most of which probably use plaintext passwords with no concern for sqli or xss...)
I'm having trouble understanding the motivation or use case. The documentation gives examples of logging in, creating filesystem-like structures, and uploading files. How is this an improvement upon a regular filesystem and scp/sftp? I do like the web console though.
Therefore, instead of dealing with key-values, objects ids and primary keys, you can access your data using file paths just as you would with a regular file system. Bytengine’s file system is modelled on the linux file system where you have a root directory ‘/’ and file paths separated by a forward slash ‘/’. Bytengine stores your content in Files that can further be organised in Directories.
Appart from being able to access your content as you would a regular file system, you can also query and modify your content metadata.
So you could upload pictures, tag them in JSON and later run live queries based on the tags from your client app (to sort them based on location for example).
I'll be adding more/better docs in the coming days.
How is this an improvement upon a regular filesystem and scp/sftp
scp/sftp is great, but if you've ever had to deal with large numbers of users trying to properly manage ssh key pairs you will know it's not an approach that will work at scale.
Don't get it. You already have a Mongo, why also use Redis just for that? I mean your Mongo is in-memory too. Or do you anticipate a larger-than-RAM dataset for the MongoDB?
The main page is active in the browser but the header says 404 Not Found, maybe it's a bug?
~$ curl -IL http://www.bytengine.com/
HTTP/1.1 404 Not Found
Server: nginx/1.1.19
~$ curl -IL http://www.bytengine.com/should_404
HTTP/1.1 404 Not Found
Server: nginx/1.1.19
I think that all that's wrong with alternatives to this kind of projects is that they are not written by the author. It's ok actually, many people and many great technologies started as pet projects; it just means that asking questions like this makes no sense :)
Okay, why?
This caught my eye so i had a look through auth.go. Passwords are salted sha1... okay, but why not bcrypt? No PBKDF2? No field for hash format versioning if you want to backwards-compatible upgrade to bcrypt in future? Guess you could always go by the salt length or something.
It looks like your code to hash the password and salt is copy-pasted and appears twice, don't do that.
Your salts are 16 random bytes, okay.. but why base64 encode the salt before hashing? Now some structure of the content is known that might expose a weakness.