Golang使用JWT实现Web身份验证

go get github.com/golang-jwt/jwt/v5

func generateToken(userID string) (string, error) {
    claims := jwt.MapClaims{
        "user_id": userID,
        "exp":     time.Now().Add(time.Hour * 72).Unix(), // 72小时过期
    }
<pre class='brush:php;toolbar:false;'>token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
return token.SignedString([]byte("your-secret-key"))

func authMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        tokenString := r.Header.Get("Authorization")
        if tokenString == "" {
            http.Error(w, "Authorization header missing", http.StatusUnauthorized)
            return
        }
<pre class='brush:php;toolbar:false;'>    // 去除 "Bearer " 前缀
    tokenString = strings.TrimPrefix(tokenString, "Bearer ")

    token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
            return nil, fmt.Errorf("unexpected signing method")
        }
        return []byte("your-secret-key"), nil
    })

    if err != nil || !token.Valid {
        http.Error(w, "Invalid or expired token", http.StatusUnauthorized)
        return
    }

    // 提取用户信息，可存入上下文
    if claims, ok := token.Claims.(jwt.MapClaims); ok {
        userID := claims["user_id"].(string)
        ctx := context.WithValue(r.Context(), "userID", userID)
        next.ServeHTTP(w, r.WithContext(ctx))
        return
    }

    http.Error(w, "Token claims invalid", http.StatusUnauthorized)
}

http.HandleFunc("/login", loginHandler)
http.HandleFunc("/protected", authMiddleware(protectedHandler))