如何在Golang中使用gRPC进行安全认证

package main

import (
    "net"
    "google.golang.org/grpc"
    "google.golang.org/grpc/credentials"
    pb "your-project/proto" // 替换为你的proto包路径
    "log"
)

type server struct {
    pb.UnimplementedYourServiceServer
}

func (s *server) YourMethod(ctx context.Context, req *pb.YourRequest) (*pb.YourResponse, error) {
    return &pb.YourResponse{Message: "Hello"}, nil
}

func main() {
    cert, err := tls.LoadX509KeyPair("server.crt", "server.key")
    if err != nil {
        log.Fatalf("无法加载证书: %v", err)
    }
    creds := credentials.NewTLS(&tls.Config{
        Certificates: []tls.Certificate{cert},
        ClientAuth:   tls.RequireAndVerifyClientCert, // 启用双向认证
        ClientCAs:    loadCA(),                      // 加载客户端CA证书池
    })

    lis, err := net.Listen("tcp", ":50051")
    if err != nil {
        log.Fatalf("监听失败: %v", err)
    }

    s := grpc.NewServer(grpc.Creds(creds))
    pb.RegisterYourServiceServer(s, &server{})
    log.Println("gRPC服务已启动，地址: :50051")
    if err := s.Serve(lis); err != nil {
        log.Fatalf("启动服务失败: %v", err)
    }
}

creds, err := credentials.NewClientTLSFromFile("server.crt", "your-server-name")
if err != nil {
    log.Fatalf("加载TLS凭证失败: %v", err)
}

conn, err := grpc.Dial("localhost:50051", 
    grpc.WithTransportCredentials(creds),
    grpc.WithPerRPCCredentials(&authInfo{}), // 可选：附加Token认证
)
if err != nil {
    log.Fatalf("连接失败: %v", err)
}
defer conn.Close()

type authInfo struct {
    Token string
}

func (a *authInfo) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
    return map[string]string{
        "authorization": "Bearer " + a.Token,
    }, nil
}

func (a *authInfo) RequireTransportSecurity() bool {
    return true // 强制使用TLS
}

cred := &authInfo{Token: "your-jwt-or-api-token"}
conn, err := grpc.Dial("localhost:50051",
    grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{})),
    grpc.WithPerRPCCredentials(cred),
)

func unaryInterceptor(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
    md, ok := metadata.FromIncomingContext(ctx)
    if !ok {
        return nil, status.Errorf(codes.Unauthenticated, "无元数据")
    }

    values := md["authorization"]
    if len(values) == 0 {
        return nil, status.Errorf(codes.Unauthenticated, "缺少授权头")
    }

    token := strings.TrimPrefix(values[0], "Bearer ")
    if !isValidToken(token) { // 自定义验证逻辑
        return nil, status.Errorf(codes.Unauthenticated, "无效Token")
    }

    return handler(ctx, req)
}

s := grpc.NewServer(
    grpc.Creds(creds),
    grpc.UnaryInterceptor(unaryInterceptor),
)