独霸JWT举办认证

JSON Web Tokens (JWT) are 举办a more modern approach to authentication.

As the web moves to a greater separation between the client and server, JWT provides a wonderful alternative to traditional cookie based authentication models.

JWTs provide a way for clients to authenticate every request without having to maintain a session or repeatedly pass login credentials to the server.

用户注册此后, 处事器生成一个 JWT token前去给不雅不雅不雅不雅鉴赏器, 不雅不雅不雅不雅鉴赏器向处事器请求数据时将 JWT token 发给处事器, 处事器用 signature 中定义的编制解码

JWT 掉落踪掉落踪用户信息.

一个 JWT token包含3部分:
1 header: 陈述我们独霸的算法和 token 圭表类型
2 Payload: 必须独霸 sub key 来指定用户 ID, 还可以包含其他信息比如 email, username 等.
3 Signature: 用来担保 JWT 的真实性. 可独霸不合算法

package mainimport (	"encoding/json"	"fmt"	"log"	"net/http"	"strings"	"time"	"github.com/codegangsta/negroni"	"github.com/dgrijalva/jwt-go"	"github.com/dgrijalva/jwt-go/request")const (	SecretKey = "welcome ---------")func fatal(err error) { 	if err != nil { 		log.Fatal(err)	}}type UserCredentials struct { 	Username string `json:"username"`	Password string `json:"password"`}type User struct { 	ID       int    `json:"id"`	Name     string `json:"name"`	Username string `json:"username"`	Password string `json:"password"`}type Response struct { 	Data string `json:"data"`}type Token struct { 	Token string `json:"token"`}func StartServer() { 	http.HandleFunc("/login", LoginHandler)	http.Handle("/resource", negroni.New(		negroni.HandlerFunc(ValidateTokenMiddleware),		negroni.Wrap(http.HandlerFunc(ProtectedHandler)),	))	log.Println("Now listening...")	http.ListenAndServe(":8087", nil)}func main() { 	StartServer()}func ProtectedHandler(w http.ResponseWriter, r *http.Request) { 	response := Response{ "Gained access to protected resource"}	JsonResponse(response, w)}func LoginHandler(w http.ResponseWriter, r *http.Request) { 	var user UserCredentials	err := json.NewDecoder(r.Body).Decode(&user)	if err != nil { 		w.WriteHeader(http.StatusForbidden)		fmt.Fprint(w, "Error in request")		return	}	if strings.ToLower(user.Username) != "someone" { 		if user.Password != "p@ssword" { 			w.WriteHeader(http.StatusForbidden)			fmt.Println("Error logging in")			fmt.Fprint(w, "Invalid credentials")			return		}	}	token := jwt.New(jwt.SigningMethodHS256)	claims := make(jwt.MapClaims)	claims["exp"] = time.Now().Add(time.Hour * time.Duration(1)).Unix()	claims["iat"] = time.Now().Unix()	token.Claims = claims	if err != nil { 		w.WriteHeader(http.StatusInternalServerError)		fmt.Fprintln(w, "Error extracting the key")		fatal(err)	}	tokenString, err := token.SignedString([]byte(SecretKey))	if err != nil { 		w.WriteHeader(http.StatusInternalServerError)		fmt.Fprintln(w, "Error while signing the token")		fatal(err)	}	response := Token{ tokenString}	JsonResponse(response, w)}func ValidateTokenMiddleware(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) { 	token, err := request.ParseFromRequest(r, request.AuthorizationHeaderExtractor,		func(token *jwt.Token) (inte***ce{ }, error) { 			return []byte(SecretKey), nil		})	if err == nil { 		if token.Valid { 			next(w, r)		} else { 			w.WriteHeader(http.StatusUnauthorized)			fmt.Fprint(w, "Token is not valid")		}	} else { 		w.WriteHeader(http.StatusUnauthorized)		fmt.Fprint(w, "Unauthorized access to this resource")	}}func JsonResponse(response inte***ce{ }, w http.ResponseWriter) { 	json, err := json.Marshal(response)	if err != nil { 		http.Error(w, err.Error(), http.StatusInternalServerError)		return	}	w.WriteHeader(http.StatusOK)	w.Header().Set("Content-Type", "application/json")	w.Write(json)}

到此这篇关于golang举办复杂权限认证的完成的文章就引见到这了,更多相干Golang 权限认证内容请搜刮完竣下载之前的文章或延续不雅不雅不雅不雅鉴赏上面的相干文章希看大年夜师往后多多支撑完竣下载！

复杂