Golang实现简单用户认证系统实例

package main

import (
    "time"
)

// User represents a user in the system
type User struct {
    ID        int       `json:"id"`
    Username  string    `json:"username"`
    Password  string    `json:"-"` // Stored as hash, never expose
    CreatedAt time.Time `json:"created_at"`
    UpdatedAt time.Time `json:"updated_at"`
}

package main

import (
    "database/sql"
    _ "github.com/mattn/go-sqlite3" // SQLite driver
    "log"
)

var db *sql.DB

func initDB() {
    var err error
    db, err = sql.Open("sqlite3", "./auth.db")
    if err != nil {
        log.Fatalf("Failed to open database: %v", err)
    }

    createTableSQL := `
    CREATE TABLE IF NOT EXISTS users (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        username TEXT NOT NULL UNIQUE,
        password TEXT NOT NULL,
        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
        updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
    );`

    _, err = db.Exec(createTableSQL)
    if err != nil {
        log.Fatalf("Failed to create users table: %v", err)
    }
    log.Println("Database initialized and table 'users' ensured.")
}

bcrypt

package main

import (
    "golang.org/x/crypto/bcrypt"
    "log"
)

// HashPassword hashes the given password using bcrypt
func HashPassword(password string) (string, error) {
    bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
    return string(bytes), err
}

// CheckPasswordHash compares a plain password with its bcrypt hash
func CheckPasswordHash(password, hash string) bool {
    err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
    return err == nil
}

// Example registration handler
func registerUser(username, password string) error {
    hashedPassword, err := HashPassword(password)
    if err != nil {
        return err
    }

    stmt, err := db.Prepare("INSERT INTO users(username, password) VALUES(?, ?)")
    if err != nil {
        return err
    }
    defer stmt.Close()

    _, err = stmt.Exec(username, hashedPassword)
    if err != nil {
        log.Printf("Error inserting user: %v", err)
        return err
    }
    log.Printf("User %s registered successfully.", username)
    return nil
}

package main

import (
    "github.com/golang-jwt/jwt/v5"
    "time"
    "fmt"
)

// Define a custom claims struct
type Claims struct {
    Username string `json:"username"`
    jwt.RegisteredClaims
}

var jwtSecret = []byte("super_secret_jwt_key") // In a real app, load this from environment variables!

// GenerateJWT generates a new JWT token for the given username
func GenerateJWT(username string) (string, error) {
    expirationTime := time.Now().Add(24 * time.Hour) // Token valid for 24 hours
    claims := &Claims{
        Username: username,
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(expirationTime),
            IssuedAt:  jwt.NewNumericDate(time.Now()),
            NotBefore: jwt.NewNumericDate(time.Now()),
        },
    }

    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
    tokenString, err := token.SignedString(jwtSecret)
    return tokenString, err
}

// Example login handler
func loginUser(username, password string) (string, error) {
    var storedPasswordHash string
    err := db.QueryRow("SELECT password FROM users WHERE username = ?", username).Scan(&storedPasswordHash)
    if err != nil {
        if err == sql.ErrNoRows {
            return "", fmt.Errorf("user not found")
        }
        return "", err
    }

    if !CheckPasswordHash(password, storedPasswordHash) {
        return "", fmt.Errorf("invalid credentials")
    }

    token, err := GenerateJWT(username)
    if err != nil {
        return "", err
    }
    log.Printf("User %s logged in, token generated.", username)
    return token, nil
}

package main

import (
    "net/http"
    "strings"
    "fmt"
)

// JWTAuthMiddleware verifies the JWT token from the Authorization header
func JWTAuthMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        authHeader := r.Header.Get("Authorization")
        if authHeader == "" {
            http.Error(w, "Authorization header required", http.StatusUnauthorized)
            return
        }

        parts := strings.Split(authHeader, " ")
        if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
            http.Error(w, "Invalid Authorization header format", http.StatusUnauthorized)
            return
        }

        tokenString := parts[1]
        token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
            if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
                return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
            }
            return jwtSecret, nil
        })

        if err != nil {
            http.Error(w, "Invalid token: "+err.Error(), http.StatusUnauthorized)
            return
        }

        if claims, ok := token.Claims.(*Claims); ok && token.Valid {
            // Token is valid, pass the username to the context if needed
            // r = r.WithContext(context.WithValue(r.Context(), "username", claims.Username))
            log.Printf("User %s authenticated.", claims.Username)
            next.ServeHTTP(w, r)
        } else {
            http.Error(w, "Invalid token claims", http.StatusUnauthorized)
        }
    })
}

gorilla/sessions

Authorization

Bearer <token>

github.com/golang-jwt/jwt/v5