Question

Currently I’m developing a GAE application in golang that would allow the users to log into the service using OpenID from Google. Each account would be mapped to one Google account obviously. Should I implement captcha for user registration, or does using the OpenID already prevent the service from a bot attack?

Answer 1

First of all, fear of a bot attack is really a preliminary caution. Parsing CSRF tokens (which you should use anyway) and dealing with cookies would already cause enough pain to an attacker. I doubt anyone would trouble himself into setting up very own OpenID provider which is the only way one can do that.

Secondly, App Engine’s OpenID Federated Login is the User API feature, not Go runtime’s one — you can use any OP with it (Facebook, Yahoo!, Steam… Google). User API provides two modes (configurable via Application Settings): OpenID Federated Login and Google Accounts sign in. Which to pick depends on requirements. If all you need is user’s Google account you’d better use the latter, when if it’s simple password-less sign in with nearly everything, choose OpenID. From the app’s perspective both look identical. Best way to go is OAuth, though.

Getting back on the question, both Google Accounts API and OAuth would make such attacks almost impossible and with OpenID it is a little simpler.

https://developers.google.com/appengine/docs/go/users/overview