Dictionary Attack in Echo Go with Cockroachdb

A dictionary attack against an Echo Go service backed by Cockroachdb typically exploits weak account enumeration or predictable credential workflows. In this stack, attackers send many username or email guesses to the login or password-reset endpoint and observe subtle differences in response behavior to infer valid accounts. Because Cockroachdb is often used in distributed environments with long-lived connections or ORM-based query builders, application code may inadvertently leak information through error messages, timing differences, or inconsistent HTTP status codes.

The vulnerability arises when the Echo Go handler performs a lookup in Cockroachdb without constant-time logic or proper input validation. For example, a query like SELECT id, password_hash FROM users WHERE email = $1 will return no rows for unknown emails, while a valid user returns a row. If the handler then branches based on whether a row exists—such as returning a 400 for unknown users and a 401 for valid users with bad passwords—it creates an account enumeration vector. Attackers use this signal to build a list of valid emails, then run credential stuffing or password spraying against those accounts.

With Cockroachdb, additional risks stem from connection handling and query patterns. If session or transaction management is not carefully controlled in Echo Go, concurrent requests may reveal whether a user exists through error codes or response latencies. Misconfigured retries or driver settings can also expose stack traces or constraint violations that hint at username formats or table structures. Because the database layer is distributed, inconsistent consistency levels across nodes may amplify timing differences, making detection easier for an attacker monitoring round-trip times.

To discover such issues, middleBrick runs checks across the authentication, input validation, and rate limiting categories. It evaluates whether the API leaks information via status codes, response timing, or error payloads when subjected to high-volume dictionary-style probes. The scan does not attempt to crack passwords; it identifies whether the API surface makes it easier to enumerate accounts or bypass lockouts when Cockroachdb is the backend.

Remediation focuses on removing user enumeration and ensuring uniform handling regardless of database outcomes. In Echo Go, this means standardizing responses, applying rate limits, and using safe SQL patterns that do not branch on existence. The following section outlines concrete code fixes to harden the integration with Cockroachdb.

Secure Echo Go handlers should treat database responses as opaque and avoid branching logic that reveals account existence. Use constant-time comparison patterns and parameterized queries to prevent information leakage to attackers. Below are concrete, working examples that integrate Cockroachdb safely with Echo Go.

First, always use prepared statements with placeholders to prevent SQL injection and ensure stable query plans. Do not concatenate user input into SQL strings.

// Good: parameterized query with database/sql/driver
stmt, err := db.Prepare(`SELECT id, password_hash, mfa_enabled FROM users WHERE email = $1`)
if err != nil {
    log.Err(err).Msg("prepare failed")
    return echo.ErrInternalServerError
}
defer stmt.Close()

Second, avoid branching on whether a user exists. Always perform a constant-time verification step (e.g., hashing the provided password with the stored hash) and return the same HTTP status and body shape regardless of user existence.

// Secure login handler pattern for Echo Go with Cockroachdb
func loginHandler(c echo.Context) error {
    var req struct {
        Email    string `json:"email"`
        Password string `json:"password"`
    }
    if err := c.Bind(&req); err != nil {
        // Always return the same shape to prevent enumeration
        return c.JSON(400, map[string]string{"error": "invalid_request"})
    }

    var storedHash string
    var mfaEnabled bool
    err := db.QueryRow(context.Background(),
        "SELECT password_hash, mfa_enabled FROM users WHERE email = $1", req.Email).Scan(&storedHash, &mfaEnabled)
    if err != nil {
        // Log internally, but return generic response
        log.Err(err).Str("email", req.Email).Msg("query error")
        return c.JSON(401, map[string]string{"error": "invalid_credentials"})
    }

    // Constant-time comparison using subtle.ConstantTimeCompare
    if subtle.ConstantTimeCompare([]byte(hashPassword(req.Password, storedHash)), []byte(storedHash)) != 1 {
        return c.JSON(401, map[string]string{"error": "invalid_credentials"})
    }

    // Continue with session or token creation
    return c.JSON(200, map[string]string{"status": "ok"})
}

Third, enforce rate limiting at the HTTP handler and connection pool level to reduce brute-force effectiveness. Use fixed-window or sliding-window counters keyed by normalized identifiers (e.g., IP or API key) rather than by username to prevent targeted attacks.

// Example rate limiting with echo-rate limit middleware
func setupRoutes(e *echo.Echo) {
    rl := middleware.NewRateLimiter(middlewareRateLimiterConfig{
        Skipper: middleware.DefaultSkipper,
        Rate:      "5s:10", // 10 requests per 5 seconds
        Burst:     20,
    })
    e.POST("/login", rl(loginHandler))
}

Fourth, configure Cockroachdb drivers and ORMs to use consistent isolation levels and avoid leaking metadata through errors. Set application_name and prefer prepared statements to reduce parsing-based timing variance.

// Example connection string with safe settings for Cockroachdb
connStr := "postgresql://user:password@host:26257/dbname?sslmode=require&application_name=echo-api&binary_parameters=yes&prefer_simple_protocol=true"
db, err := sql.Open("postgres", connStr)
if err != nil {
    log.Fatal().Err(err).Msg("db open failed")
}

Finally, validate and normalize all inputs before using them in queries. Reject emails with unexpected formats and enforce length and character constraints to reduce edge-case behavior that could amplify timing differences.

By combining these patterns—parameterized queries, constant-time flows, uniform error handling, and strict rate limiting—you reduce the attack surface for dictionary attacks in an Echo Go + Cockroachdb deployment. middleBrick can validate these defenses by checking authentication workflows, input validation, and rate limiting under its 12 parallel security checks.