Golang使用JWT实现身份认证示例

github.com/golang-jwt/jwt/v5

Claims

ExpiresAt

package main

import (
    "fmt"
    "log"
    "net/http"
    "time"

    "github.com/golang-jwt/jwt/v5"
)

// 定义一个我们自己的Claims，它包含StandardClaims以及我们自定义的字段
type MyClaims struct {
    Username string `json:"username"`
    jwt.RegisteredClaims
}

var jwtSecret = []byte("这是一个非常安全的密钥，请务必替换掉它！") // 生产环境请务必从环境变量或配置中读取

// Login 模拟用户登录，成功后生成JWT
func Login(w http.ResponseWriter, r *http.Request) {
    // 这里省略了实际的用户名密码验证逻辑
    username := "testuser" // 假设验证成功，获取到用户名

    // 设置Token的过期时间，比如1小时
    expirationTime := time.Now().Add(1 * time.Hour)
    claims := &MyClaims{
        Username: username,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(expirationTime),
            IssuedAt:  jwt.NewNumericDate(time.Now()),
            Subject:   username,
        },
    }

    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
    tokenString, err := token.SignedString(jwtSecret)
    if err != nil {
        w.WriteHeader(http.StatusInternalServerError)
        fmt.Fprintf(w, "生成Token失败: %v", err)
        return
    }

    // 将Token返回给客户端
    fmt.Fprintf(w, `{"token": "%s"}`, tokenString)
}

// AuthMiddleware 是一个JWT认证中间件
func AuthMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        tokenString := r.Header.Get("Authorization")
        if tokenString == "" {
            w.WriteHeader(http.StatusUnauthorized)
            fmt.Fprint(w, "未提供认证Token")
            return
        }

        // 移除"Bearer "前缀
        if len(tokenString) > 7 && tokenString[:7] == "Bearer " {
            tokenString = tokenString[7:]
        } else {
            w.WriteHeader(http.StatusUnauthorized)
            fmt.Fprint(w, "Token格式错误，应为 'Bearer <token>'")
            return
        }

        claims := &MyClaims{}
        token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
            // 验证签名方法是否是我们预期的HS256
            if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
                return nil, fmt.Errorf("非法的签名方法: %v", token.Header["alg"])
            }
            return jwtSecret, nil
        })

        if err != nil {
            if err == jwt.ErrSignatureInvalid {
                w.WriteHeader(http.StatusUnauthorized)
                fmt.Fprint(w, "Token签名无效")
                return
            }
            // 检查Token是否过期
            if ve, ok := err.(*jwt.ValidationError); ok {
                if ve.Errors&jwt.ValidationErrorExpired != 0 {
                    w.WriteHeader(http.StatusUnauthorized)
                    fmt.Fprint(w, "Token已过期")
                    return
                }
            }
            w.WriteHeader(http.StatusBadRequest)
            fmt.Fprintf(w, "解析Token失败: %v", err)
            return
        }

        if !token.Valid {
            w.WriteHeader(http.StatusUnauthorized)
            fmt.Fprint(w, "Token无效")
            return
        }

        // 如果Token有效，可以将用户信息存储在请求上下文中，供后续Handler使用
        // r = r.WithContext(context.WithValue(r.Context(), "username", claims.Username))
        fmt.Printf("用户 %s 认证成功\n", claims.Username)
        next.ServeHTTP(w, r)
    }
}

// ProtectedHandler 只有认证通过的用户才能访问
func ProtectedHandler(w http.ResponseWriter, r *http.Request) {
    // username := r.Context().Value("username").(string) // 从上下文中获取用户信息
    fmt.Fprint(w, "恭喜，你已成功访问受保护的资源！")
}

func main() {
    http.HandleFunc("/login", Login)
    http.HandleFunc("/protected", AuthMiddleware(ProtectedHandler))

    fmt.Println("服务器正在监听 :8080")
    log.Fatal(http.ListenAndServe(":8080", nil))
}

Username

MyClaims

jwt.ParseWithClaims

jwtSecret

token.Valid

true

jwtSecret

localStorage

sessionStorage

httpOnly

httpOnly

AuthMiddleware

jwt.ErrSignatureInvalid

jwt.ValidationErrorExpired

jwt.ValidationErrorMalformed

jwt.ValidationErrorNotValidYet

github.com/dgrijalva/jwt-go

github.com/golang-jwt/jwt/v5

jwt-go

jwt/v5

jwt/v5

localStorage

httpOnly

jti

jti