hashPassword, _ := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
_, err = db.Exec("INSERT INTO users(usrname, password) VALUES(?, ?)", username, password)
1) ignore an error, if any? And then
2) ignore hashPassword and just insert the non-hashed password into the database?
It looks like if someone follows along from home they'll get a syntax error from "usrname" but let's say they fixed that...
The code at the bottom of the article doesn't seem to suffer from the latter issue, but still suffers from the former.
edit: Otherwise, great read! Hoping for more.
Security related tutorials should not skip steps, even if only to mention the more advanced of them.
var db *sql.DB
var err error
The err: because they use it so frequently, easier to define it once and simply assign to it multiple times than try and track if it's already been defined per block of code.
Personally, I prefer to use distinct error variables for each error which can be thrown, but either method is idiomatic.
Much better to http.Redirect/5xx.
The main() function doesn't "end" until the web listener is stopped, correct?
This is actually the intended usage of `sql.Open()`: https://golang.org/pkg/database/sql/#Open (it maintains its own connection pool and is safe for concurrent use)