Golang实现JWT认证怎么做 生成和验证Token完整流程

github.com/golang-jwt/jwt/v5

golang-jwt/jwt

go get github.com/golang-jwt/jwt/v5

package main

import (
    "fmt"
    "net/http"
    "time"

    "github.com/golang-jwt/jwt/v5"
)

// 密钥，应保存在环境变量中
var jwtKey = []byte("your-secret-key-change-in-production")

// 定义用户声明（Claims）
type Claims struct {
    UserID uint   `json:"user_id"`
    Email  string `json:"email"`
    jwt.RegisteredClaims
}

func generateToken(userID uint, email string) (string, error) {
    expirationTime := time.Now().Add(24 * time.Hour) // 24小时有效期

    claims := &Claims{
        UserID: userID,
        Email:  email,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(expirationTime),
            IssuedAt:  jwt.NewNumericDate(time.Now()),
            NotBefore: jwt.NewNumericDate(time.Now()),
            Issuer:    "your-app-name",
            Subject:   fmt.Sprintf("user-%d", userID),
        },
    }

    // 创建 token 对象
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

    // 签名并生成字符串
    tokenString, err := token.SignedString(jwtKey)
    if err != nil {
        return "", err
    }

    return tokenString, nil
}

Authorization: Bearer <token>

func validateToken(tokenString string) (*Claims, error) {
    claims := &Claims{}

    token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
        // 验证签名算法是否正确
        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
            return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
        }
        return jwtKey, nil
    })

    if err != nil {
        return nil, err
    }

    if !token.Valid {
        return nil, fmt.Errorf("invalid token")
    }

    return claims, nil
}

func authMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        authHeader := r.Header.Get("Authorization")
        if authHeader == "" {
            http.Error(w, "Authorization header missing", http.StatusUnauthorized)
            return
        }

        // Bearer <token>
        var tokenString string
        if len(authHeader) > 7 && authHeader[:7] == "Bearer " {
            tokenString = authHeader[7:]
        } else {
            http.Error(w, "Invalid authorization format", http.StatusUnauthorized)
            return
        }

        claims, err := validateToken(tokenString)
        if err != nil {
            http.Error(w, "Invalid or expired token", http.StatusUnauthorized)
            return
        }

        // 可将用户信息存入上下文，供后续处理使用
        // 这里简单打印
        fmt.Printf("Authenticated user: %s (ID: %d)\n", claims.Email, claims.UserID)

        next(w, r)
    }
}

func loginHandler(w http.ResponseWriter, r *http.Request) {
    // 模拟登录验证（实际应查数据库）
    email := r.FormValue("email")
    password := r.FormValue("password")

    // 简单模拟验证
    if email == "user@example.com" && password == "pass123" {
        token, err := generateToken(123, email)
        if err != nil {
            http.Error(w, "Failed to generate token", http.StatusInternalServerError)
            return
        }

        w.Header().Set("Content-Type", "application/json")
        fmt.Fprintf(w, `{"token": "%s"}`, token)
        return
    }

    http.Error(w, "Invalid credentials", http.StatusUnauthorized)
}

func protectedHandler(w http.ResponseWriter, r *http.Request) {
    w.Write([]byte("This is a protected route!"))
}

func main() {
    http.HandleFunc("/login", loginHandler)
    http.HandleFunc("/protected", authMiddleware(protectedHandler))

    fmt.Println("Server starting on :8080")
    http.ListenAndServe(":8080", nil)
}

curl -X POST http://localhost:8080/login \
  -d "email=user@example.com" \
  -d "password=pass123"

{"token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xxxxx"}

curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xxxxx" \
  http://localhost:8080/protected