Go does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.
Re:Show HN: CMS Server written in Go (alpha)
by wilsonfiifi on Saturday June 01, 2013 @03:00PM
(#5805405)
Thanks for pointing that out. Will look into it
If not, I think there is potential for a timing attack here?
if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }