Golang如何实现用户登录功能_Golang 用户登录功能实践

type User struct {
    ID       int
    Username string
    Password string // 实际存储应为哈希值
}

CREATE TABLE users (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    username TEXT UNIQUE NOT NULL,
    password TEXT NOT NULL
);

import "golang.org/x/crypto/bcrypt"

hashed, _ := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)

func loginHandler(w http.ResponseWriter, r *http.Request) {
    if r.Method != "POST" {
        http.Error(w, "Method not allowed", 405)
        return
    }

    username := r.FormValue("username")
    password := r.FormValue("password")

    var user User
    err := db.QueryRow("SELECT id, username, password FROM users WHERE username = ?", username).
        Scan(&user.ID, &user.Username, &user.Password)

    if err != nil {
        http.Error(w, "Invalid credentials", 401)
        return
    }

    if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(password)); err != nil {
        http.Error(w, "Invalid credentials", 401)
        return
    }

    // 设置 session（示例使用简单 cookie）
    sessionToken := generateSessionToken()
    http.SetCookie(w, &http.Cookie{
        Name:  "session_token",
        Value: sessionToken,
        Path:  "/",
    })

    // 可选：将 token 存入内存或 Redis 关联用户
    sessions[sessionToken] = user.ID

    w.Write([]byte("Login successful"))
}

func authMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        cookie, err := r.Cookie("session_token")
        if err != nil {
            http.Redirect(w, r, "/login", 302)
            return
        }

        userID, exists := sessions[cookie.Value]
        if !exists {
            http.Redirect(w, r, "/login", 302)
            return
        }

        // 将用户信息传递给后续处理函数
        ctx := context.WithValue(r.Context(), "userID", userID)
        next.ServeHTTP(w, r.WithContext(ctx))
    }
}

http.HandleFunc("/dashboard", authMiddleware(dashboardHandler))