Skip to content

Instantly share code, notes, and snippets.

@cryptix
Last active Feb 23, 2022
Embed
What would you like to do?
example of using JWT for http authentication in go
// SPDX-FileCopyrightText: 2021 Henry Bubert <cryptix@riseup.net>
//
// SPDX-License-Identifier: MIT
package main
// using asymmetric crypto/RSA keys
import (
"crypto/rsa"
"fmt"
"io/ioutil"
"log"
"net/http"
jwt "github.com/dgrijalva/jwt-go"
)
// location of the files used for signing and verification
const (
privKeyPath = "keys/app.rsa" // openssl genrsa -out app.rsa keysize
pubKeyPath = "keys/app.rsa.pub" // openssl rsa -in app.rsa -pubout > app.rsa.pub
)
// keys are held in global variables
// i havn't seen a memory corruption/info leakage in go yet
// but maybe it's a better idea, just to store the public key in ram?
// and load the signKey on every signing request? depends on your usage i guess
var (
verifyKey *rsa.PublicKey
signKey *rsa.PrivateKey
)
// read the key files before starting http handlers
func init() {
signBytes, err := ioutil.ReadFile(privKeyPath)
fatal(err)
signKey, err = jwt.ParseRSAPrivateKeyFromPEM(signBytes)
fatal(err)
verifyBytes, err := ioutil.ReadFile(pubKeyPath)
fatal(err)
verifyKey, err = jwt.ParseRSAPublicKeyFromPEM(verifyBytes)
fatal(err)
}
func fatal(err error) {
if err != nil {
log.Fatal(err)
}
}
// just some html, to lazy for http.FileServer()
const (
tokenName = "AccessToken"
landingHtml = `<h2>Welcome to the JWT Test</h2>
<a href="/restricted">fun area</a>
<form action="/authenticate" method="POST">
<input type="text" name="user">
<input type="password" name="pass">
<input type="submit">
</form>`
successHtml = `<h2>Token Set - have fun!</h2><p>Go <a href="/">Back...</a></p>`
restrictedHtml = `<h1>Welcome!!</h1><img src="https://httpcats.herokuapp.com/200" alt="" />`
)
// serves the form and restricted link
func landingHandler(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "text/html")
w.WriteHeader(http.StatusOK)
fmt.Fprint(w, landingHtml)
}
type UserInfo struct {
Name, Kind string
}
type AccessClaims struct {
Access string
UserInfo UserInfo
jwt.StandardClaims
}
// reads the form values, checks them and creates the token
func authHandler(w http.ResponseWriter, r *http.Request) {
// make sure its post
if r.Method != "POST" {
w.WriteHeader(http.StatusBadRequest)
fmt.Fprintln(w, "No POST", r.Method)
return
}
user := r.FormValue("user")
pass := r.FormValue("pass")
log.Printf("Authenticate: user[%s] pass[%s]\n", user, pass)
// check values
if user != "test" || pass != "known" {
w.WriteHeader(http.StatusForbidden)
fmt.Fprintln(w, "Wrong info")
return
}
// set our claims
claims := AccessClaims{
Access: "level1",
UserInfo: UserInfo{user, "human"},
StandardClaims: jwt.StandardClaims{
ExpiresAt: 15000,
Issuer: "asym-example",
},
}
// create a signer for rsa 256
t := jwt.NewWithClaims(jwt.GetSigningMethod("RS256"), claims)
tokenString, err := t.SignedString(signKey)
if err != nil {
w.WriteHeader(http.StatusInternalServerError)
fmt.Fprintln(w, "Sorry, error while Signing Token!")
log.Printf("Token Signing error: %v\n", err)
return
}
// i know using cookies to store the token isn't really helpfull for cross domain api usage
// but it's just an example and i did not want to involve javascript
http.SetCookie(w, &http.Cookie{
Name: tokenName,
Value: tokenString,
Path: "/",
RawExpires: "0",
})
w.Header().Set("Content-Type", "text/html")
w.WriteHeader(http.StatusOK)
fmt.Fprintln(w, successHtml)
}
// only accessible with a valid token
func restrictedHandler(w http.ResponseWriter, r *http.Request) {
// check if we have a cookie with out tokenName
tokenCookie, err := r.Cookie(tokenName)
switch {
case err == http.ErrNoCookie:
w.WriteHeader(http.StatusUnauthorized)
fmt.Fprintln(w, "No Token, no fun!")
return
case err != nil:
w.WriteHeader(http.StatusInternalServerError)
fmt.Fprintln(w, "Error while Parsing cookie!")
log.Printf("Cookie parse error: %v\n", err)
return
}
// just for the lulz, check if it is empty.. should fail on Parse anyway..
if tokenCookie.Value == "" {
w.WriteHeader(http.StatusUnauthorized)
fmt.Fprintln(w, "No Token, no fun!")
return
}
// validate the token
token, err := jwt.Parse(tokenCookie.Value, func(token *jwt.Token) (interface{}, error) {
// since we only use the one private key to sign the tokens,
// we also only use its public counter part to verify
return verifyKey, nil
})
// branch out into the possible error from signing
switch err.(type) {
case nil: // no error
if !token.Valid { // but may still be invalid
w.WriteHeader(http.StatusUnauthorized)
fmt.Fprintln(w, "WHAT? Invalid Token? F*** off!")
return
}
// see stdout and watch for the CustomUserInfo, nicely unmarshalled
log.Printf("Someone accessed resricted area! Token:%+v\n", token)
w.Header().Set("Content-Type", "text/html")
w.WriteHeader(http.StatusOK)
fmt.Fprintln(w, restrictedHtml)
case *jwt.ValidationError: // something was wrong during the validation
vErr := err.(*jwt.ValidationError)
switch vErr.Errors {
case jwt.ValidationErrorExpired:
w.WriteHeader(http.StatusUnauthorized)
fmt.Fprintln(w, "Token Expired, get a new one.")
return
default:
w.WriteHeader(http.StatusInternalServerError)
fmt.Fprintln(w, "Error while Parsing Token!")
log.Printf("ValidationError error: %+v\n", vErr.Errors)
return
}
default: // something else went wrong
w.WriteHeader(http.StatusInternalServerError)
fmt.Fprintln(w, "Error while Parsing Token!")
log.Printf("Token parse error: %v\n", err)
return
}
}
// setup the handlers and start listening to requests
func main() {
http.HandleFunc("/", landingHandler)
http.HandleFunc("/authenticate", authHandler)
http.HandleFunc("/restricted", restrictedHandler)
log.Println("Listening...")
fatal(http.ListenAndServe(":8080", nil))
}
// SPDX-FileCopyrightText: 2021 Henry Bubert <cryptix@riseup.net>
//
// SPDX-License-Identifier: MIT
module gist.github.com/cryptix/45c33ecf0ae54828e63b
go 1.17
require github.com/dgrijalva/jwt-go v3.2.0+incompatible
github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
MIT License
Copyright (c) <year> <copyright holders>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@vishr
Copy link

vishr commented Jun 29, 2014

You can typecast claims like below:

usr, _ := t.Claims["usr"].(User)

@skarllot
Copy link

skarllot commented Feb 23, 2015

The server should never receive the user password.

The user should send HMAC(user, password), various rounds should be desirable. And the server should use that hash as password and re-hash it using salt, like a plain text password, to store to database.

@elithrar
Copy link

elithrar commented Apr 19, 2015

@skarllot — that's not quite true. If you're using TLS (HTTPS) then the user sending a clear text password is not a problem: the transport layer will protect against man-in-the-middle attacks.

HMAC'ing the user password means you need to rely on JS in the browser to perform the HMAC. If you are serving that JavaScript then you need to serve it over TLS (else the user can be trivially MitM'ed anyway). If you don't trust that TLS to send the cleartext password then you can't trust it to send your JavaScript HMAC function either.

TL;DR: Sending plaintext passwords over HTTPS, to be input into a key derivation function like bcrypt, scrypt or PBKDF2 is fine.

@deepakchoudhary
Copy link

deepakchoudhary commented Jul 29, 2015

@elithrar — I agree with @skarliot since if the server is compromised then the hacker can't read the password , which the user might very well be using on other sites as well , thus reducing risk for the user.

@dopamane
Copy link

dopamane commented Aug 16, 2015

This helped me so much, thank you!

@waltton
Copy link

waltton commented Nov 29, 2015

First of all, thank you very much this helped me a lot.
Just wanna share about a problem that I had trying to use the package on windows. I got stuck in an error "Invalid Key: Key must be PEM encoded PKCS1 vs PKCS8 private key". I solved by using git bash instead of PowerShell to generate do keys.

@stevenferrer
Copy link

stevenferrer commented May 18, 2017

Hey thanks! gotta try this one

@LordRahl90
Copy link

LordRahl90 commented Jan 31, 2018

Thanks for this, although am having issues using the SignedKey to create a token string, its failing fo a reason i cant determine for now, but then, How do u validate the expiration of the token??? Thanks again.

@yoadwo
Copy link

yoadwo commented Oct 31, 2019

the comment specifying how to generate rsa keys:
openssl rsa -in app.rsa -pubout > app.rsa.pub - i believe should be openssl rsa -in app.rsa -pubout -out app.rsa.pub (according to openssl.org)

@hrieke
Copy link

hrieke commented Aug 11, 2021

Great stuff and thank you for posting this.
Do you have a license that you wish to apply to this code?
Thank you

@cryptix
Copy link
Author

cryptix commented Aug 12, 2021

@hrieke updated

ps: also fixed the claims creation via NewWithClaims and jwt.StandardClaims

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment