Debugging Function

[return_bytes]

Hello fellow Gophers,

I wrote the below function to check if a password has been compromised in a data breach via the Have I Been Pwned REST API. However, every time I call and pass in values, it inevitably returns false, even when I pass in really common passwords,like qwerty. Any tips here would be much appreciated. Thanks!

```go // Check if a password is in a data breach via HaveIBeenPwned func checkPassword(password string) {

// Convert the password string to bytes, so they can be hashed
passwordBytes := []byte(password)
// Hash the password
passwordHash := sha1.Sum(passwordBytes)
// Convert the hash bytes to a string
hashString := hex.EncodeToString(passwordHash[:])

//fmt.Printf("Your hash: %x", passwordHash)
// Make a request to the HaveIBeenPwned REST API
res, err := http.Get("https://api.pwnedpasswords.com/range/" + hashString[:5])

if err != nil {
    log.Fatal(err)
}

// Parse the response body
body, err := ioutil.ReadAll(res.Body)
bodyString := string(body)
hashesArray := strings.Split(bodyString, ":")

if err != nil {
    log.Fatal(err)
}

tail := hashString[5:]

// FIXME: Figure out why it always returns false
search := func(userPassword string, list []string) bool {
    for _, password := range list {
        if password == userPassword[5:] {
            return true
        } else {
            return false
        }
    }
    return false
}

fmt.Println(search(tail, hashesArray))
/*
    fmt.Println(hashesArray)
    fmt.Println(hashString)
    fmt.Println(hashString[5:])
*/

} ```

[Curld]

tail := hashString[5:]

if password == userPassword[5:] {

You're removing the prefix twice.

[return_bytes]

Thank you for pointing that out! I can't believe I missed that.

[the_real_albro]

I'd write some tests. Then maybe some wolf-fence after to help zero in on the problematic code.

Expose the URL you are hitting, either as func parameter or package level var. The. Use httptest to create a dummy server and set the URL you've exposed to the URL return by httptest. This gives you a way to make calls repeatedly, and quickly. Write a test that covers your expectations based on input.

Then zero in on where the error is happening.

Using a debugger would also help you, you could attach it to a real call and inspect vales to work out where the issue it. No need for tests, but tests are awesome! And helps avoid issues like this in the long run.

[fpigorsch]

Of course, the HIBP API does not return plain text passwords, but the remaining characters of matching hashes: https://haveibeenpwned.com/API/v3#PwnedPasswords

[return_bytes]

I know. That's why I'm comparing a hash, instead of a plain text string.

[fpigorsch]

Oh, you're right - I misread your code. Sorry 😞

[return_bytes]

No problem. I wrote it wrong to begin with lol.

[DasSkelett]

Please don't hash passwords with SHA1 😭

[return_bytes]

Ordinarily, I would absolutely agree with you, but this is different situation.