Side Channel Attack in Echo Go with Cockroachdb

A side channel attack in an Echo Go service that uses CockroachDB can occur when timing information, error messages, or request patterns leak data about the database or authentication state. In Go services built with the Echo framework, HTTP handlers often interact with CockroachDB using database/sql or a driver-specific client. If query execution paths or response construction vary in time based on secret conditions—such as whether a row exists or whether a user is authorized—an attacker can infer sensitive information by measuring response times.

For example, consider a login endpoint that queries CockroachDB for a user record and then performs a constant-time comparison of a password hash. If the comparison short-circuits on the first mismatching byte and returns early, the attacker can send many crafted requests and observe slightly longer responses when the username exists, even if the password is wrong. Because CockroachDB is a distributed SQL database, network latency and query planning add variability; when combined with non-constant-time logic in Go, these variations become measurable side channels.

Another scenario involves authorization checks. An endpoint might fetch a user’s permissions from CockroachDB and conditionally include sensitive fields in the JSON response. If the handler takes a different code path or adds extra processing when a permission is missing, an attacker can infer the presence or absence of specific rights by observing timing differences. In distributed deployments, CockroachDB’s multi-node architecture can introduce additional timing noise, but careful instrumentation can still reveal deviations caused by application logic rather than network conditions.

Echo Go handlers that parse IDs from the URL and directly interpolate them into CockroachDB queries without proper validation can also expose timing differences related to SQL execution plans. If an index is missing or a query plan changes based on data distribution, response times can vary. When these variations correlate with attacker-controlled inputs, they can be exploited in a side channel attack to infer IDs or the structure of the database.

To detect such issues, scanning an Echo Go service backed by CockroachDB with middleBrick can surface insecure patterns in authentication flows, authorization checks, and input handling. middleBrick tests such endpoints as part of its unauthenticated attack surface analysis, flagging findings related to timing-sensitive logic and providing remediation guidance consistent with OWASP API Top 10 and other compliance frameworks.

Remediation focuses on ensuring that all database interactions in Echo Go handlers execute in constant time with respect to secrets and authorization states, and that errors do not leak information about database structure or authentication.

First, use constant-time comparison for any secret values, such as password hashes. The standard library’s subtle.ConstantTimeCompare should be used instead of a naive byte-by-byte equality check. This prevents timing differences that correlate with how many bytes of a hash match.

package main

import (
	"crypto/subtle"
	"net/http"

	"github.com/labstack/echo/v4"
)

type loginRequest struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

// Assume this function queries CockroachDB and returns a stored hash for the user.
// If the user is not found, it returns an empty hash and a non-nil error.
func getUserHashFromCockroachDB(username string) ([]byte, error) {
	// Implementation that runs a parameterized query against CockroachDB.
	// Returns hash or empty+error if not found.
	return nil, nil
}

func loginHandler(c echo.Context) error {
	var req loginRequest
	if err := c.Bind(&req); err != nil {
		return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid_request"})
	}

	storedHash, err := getUserHashFromCockroachDB(req.Username)
	// Always perform a comparison to avoid timing leaks that reveal username existence.
	givenHash := []byte(req.Password) // In real code, derive the hash with proper KDF.
	if subtle.ConstantTimeCompare(givenHash, storedHash) != 1 {
		// Return a generic error and a 401 status without indicating which field was wrong.
		return c.JSON(http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
	}

	return c.JSON(http.StatusOK, map[string]string{"status": "ok"})
}

Second, avoid branching on sensitive data or database metadata. When fetching user permissions or profile data from CockroachDB, ensure that the handler follows the same code path regardless of whether the row exists. Fill in default, safe values when data is missing so that execution time remains consistent.

package main

import (
	"context"
	"net/http"

	"github.com/labstack/echo/v4"
	"github.com/lib/pq"
)

type userProfile struct {
	DisplayName string
	Email       string
	Role        string
}

func getProfileFromCockroachDB(ctx context.Context, userID string) (userProfile, error) {
	var prof userProfile
	// Use a parameterized query to prevent SQL injection and ensure stable query plans.
	row := db.QueryRowContext(ctx, "SELECT display_name, email, role FROM users WHERE id = $1", userID)
	err := row.Scan(&prof.DisplayName, &prof.Email, &prof.Role)
	if err != nil {
		if err == pq.ErrNoRows {
			// Return a default profile instead of a distinct error path.
			prof = userProfile{
				DisplayName: "Guest",
				Email:       "",
				Role:        "user",
			}
			return prof, nil
		}
		// Log the error internally but return a generic safe profile.
		prof = userProfile{
			DisplayName: "Guest",
			Email:       "",
			Role:        "user",
		}
		return prof, nil
	}
	return prof, nil
}

func profileHandler(c echo.Context) error {
	userID := c.Param("id")
	prof, err := getProfileFromCockroachDB(c.Request().Context(), userID)
	if err != nil {
		// A generic error response to avoid leaking database details.
		return c.JSON(http.StatusInternalServerError, map[string]string{"error": "server_error"})
	}
	return c.JSON(http.StatusOK, prof)
}

Third, parameterize all queries and ensure that indexes exist on commonly filtered columns to keep query execution times predictable. Missing indexes can cause full table scans that vary in duration as data grows, creating a side channel based on request size and dataset state.

-- Example DDL for CockroachDB to stabilize query performance.
CREATE TABLE users (
    id UUID PRIMARY KEY,
    username STRING UNIQUE NOT NULL,
    password_hash STRING NOT NULL,
    display_name STRING,
    email STRING,
    role STRING DEFAULT 'user'
);

-- Ensure index on columns used in WHERE clauses in Echo Go handlers.
CREATE INDEX idx_users_username ON users (username);

Finally, configure Echo Go to standardize error responses and avoid detailed database errors reaching the client. Use middleware to catch panics and format consistent error payloads so timing differences do not reveal stack traces or constraint violations.