JSON Web Token Authentication with Golang

A guide on how to implement JSON Web Token (JWT) authentication in a Golang application. This article details how to create, sign, and verify JWTs to secure an API.

In this article, we will explore how to set up and use JWT for user authentication in a Golang application. JWT is an open standard for transmitting information securely between parties. We will build a simple API capable of authenticating users using JWT.

Golang Code

package main

import (
	"fmt"
	"net/http"
	"github.com/dgrijalva/jwt-go"
	"time"
)

var mySigningKey = []byte("secret")

// Define the structure for the token
type Claims struct {
	Username string `json:"username"`
	jwt.StandardClaims
}

// Function to create the token
func CreateToken(username string) (string, error) {
	expirationTime := time.Now().Add(5 * time.Minute)
	claims := &Claims{
		Username: username,
		StandardClaims: jwt.StandardClaims{
			ExpiresAt: expirationTime.Unix(),
		},
	}
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	return token.SignedString(mySigningKey)
}

// Function to validate the token
func ValidateToken(w http.ResponseWriter, r *http.Request) {
	tokenString := r.Header.Get("Authorization")
	if tokenString == "" {
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
	}

	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
		return mySigningKey, nil
	})

	if err != nil || !token.Valid {
		http.Error(w, "Unauthorized", http.StatusUnauthorized)
		return
	}

	fmt.Fprintf(w, "Token is valid!")
}

// Function to handle login requests
func Login(w http.ResponseWriter, r *http.Request) {
	username := r.URL.Query().Get("username")
	token, err := CreateToken(username)
	if err != nil {
		http.Error(w, "Unable to create token", http.StatusInternalServerError)
		return
	}

	w.Header().Set("Authorization", token)
	fmt.Fprintf(w, "Token: %s", token)
}

func main() {
	http.HandleFunc("/login", Login)
	http.HandleFunc("/validate", ValidateToken)
	fmt.Println("Server starting on :8080")
	http.ListenAndServe(":8080", nil)
}

Detailed explanation:

1. package main: Defines the main package of the application.
2. import: Imports necessary packages, including http and jwt-go.
3. var mySigningKey = []byte("secret"): Declares a secret key to sign the token.
4. type Claims struct {...}: Defines the Claims structure to hold information in the token.
5. func CreateToken(username string): Function to create a JWT.
6. expirationTime := time.Now().Add(5 * time.Minute): Sets the expiration time for the token.
7. token := jwt.NewWithClaims(...): Creates a new token with the defined Claims.
8. return token.SignedString(mySigningKey): Signs the token and returns it as a string.
9. func ValidateToken(...): Function to validate the token from the header.
10. token, err := jwt.Parse(...): Parses the token from the string and checks its validity.
11. if err != nil || !token.Valid {...}: Checks if the token is valid.
12. func Login(...): Handles login requests, creates, and returns a token for the user.
13. func main(): The main function, sets up routes for the server, and starts the server.

System requirements:

• Golang version: 1.15 or higher.
• Library jwt-go: can be installed using the command go get github.com/dgrijalva/jwt-go.

How to install the libraries needed to run the Golang code above:

Run the following command in your terminal to install the jwt-go library:

go get github.com/dgrijalva/jwt-go

Tips:

• Use a strong and secure secret key for signing the tokens.
• The expiration time of the token should be set reasonably to ensure security without disrupting user experience.

---