Hertz Auth0 JWT Middleware

claims.go

package main

import (
	"context"
	"strings"

	"github.com/cloudwego/hertz/pkg/common/hlog"
)

type Claims struct {
	Scope string `json:"scope"`
}

func (c *Claims) Validate(ctx context.Context) error {
	hlog.Infof("claims scope: %+v", c.Scope)
	return nil
}

func (c *Claims) HasScope(expectedScope string) bool {
	result := strings.Split(c.Scope, " ")
	for i := range result {
		if result[i] == expectedScope {
			return true
		}
	}

	return false
}

jwt.go

package main

import (
	"context"
	"errors"
	"net/url"
	"os"
	"strings"
	"time"

	"github.com/auth0/go-jwt-middleware/v2/jwks"
	"github.com/auth0/go-jwt-middleware/v2/validator"
	"github.com/cloudwego/hertz/pkg/app"
	"github.com/cloudwego/hertz/pkg/common/hlog"
	"github.com/cloudwego/hertz/pkg/protocol/consts"
)

func CheckJwt() app.HandlerFunc {
  	audiences := []string{os.Getenv("AUTH0_AUDIENCE")}
	issuerUrl, err := url.Parse("https://" + os.Getenv("AUTH0_DOMAIN") + "/")
	if err != nil {
		hlog.Fatalf("Failed to parse the issuer url: %v", err)
	}

	cacheProvider := jwks.NewCachingProvider(issuerUrl, time.Hour)
	jwtValidator, err := validator.New(
		cacheProvider.KeyFunc,
		validator.RS256,
		issuerUrl.String(),
		audiences,
		validator.WithCustomClaims(func() validator.CustomClaims {
			return &Claims{}
		}),
		validator.WithAllowedClockSkew(time.Minute),
	)
	if err != nil {
		hlog.Fatalf("failed to set up the validator: %v", err)
	}

	return func(ctx context.Context, c *app.RequestContext) {
		token, err := jwtFromHeader("Authorization", "Bearer")(c)
		if err != nil {
			hlog.Warnf("failed to get token from header: %v", err)
			c.AbortWithError(consts.StatusUnauthorized, err)
			return
		}

		claims, err := jwtValidator.ValidateToken(ctx, token)
		if err != nil {
			hlog.Warnf("failed to validate token: %v", err)
			c.AbortWithError(consts.StatusUnauthorized, err)
			return
		}

		c.Set("claims", claims)

		c.Next(ctx)
	}
}

func jwtFromHeader(header string, authScheme string) func(c *app.RequestContext) (string, error) {
	return func(c *app.RequestContext) (string, error) {
		auth := c.Request.Header.Get(header)
		l := len(authScheme)
		if len(auth) > l+1 && strings.EqualFold(auth[:l], authScheme) {
			return auth[l+1:], nil
		}
		return "", errors.New("missing or malformed JWT")
	}
}