How To Build JWT’s in Go (Golang)

By Lane Wagner – @wagslane on Twitter

Go is becoming very popular for backend web development, and JWT’s are one of the most popular ways to handle authentication on API requests. In this article, we are going to go over the basics of JWT’s and how to implement a secure authentication strategy in Go!

What is a JWT?

JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.

https://jwt.io/

More simply put, JWT’s are encoded JSON objects that have been signed by the server, verifying authenticity.

For example, when a user logs in to a website secured via JWTs, the flow should look something like this:

  1. The user sends a username and password to the server
  2. The server verifies username and password are correct
  3. The server creates a JSON object (aka claims) that looks like this:
    1. {“username”:”wagslane”}
  4. The server encodes and signs the JSON object, creating a JWT:
    1. eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IndhZ3NsYW5lIn0.ov6d8XtwQoKUwsYahk9UwH333NICElFSs6ag6pINyPQ
  5. The user’s web client saves the JWT for later use
  6. When the user makes a request to a protected endpoint, the JWT is passed along in an HTTP header
  7. The server checks the signature on the JWT to make sure the JWT was originally created by the same server
  8. The server reads the claims and gives permission to the request to operate as “wagslane”

Create a JWT

We are going to use a popular library for dealing with JSON Web Tokens’s in Go, jwt-go. Make sure you have the code cloned locally:

go get github.com/dgrijalva/jwt-go

For simplicity, we are building a symmetric encryption scheme. This means we assume that the server that creates the JWTs will also be the only server that will be verifying them.

First, define a struct that will be used to represent claims to identify our users:

type customClaims struct {
        Username string `json:"username"`
        jwt.StandardClaims
}

The jwt.StandardClaims struct contains useful fields like expiry and issuer name. Now we will create some actual claims for the user that just logged in:

claims := customClaims{
        Username: username,
        StandardClaims: jwt.StandardClaims{
                ExpiresAt: 15000,
                Issuer:    "nameOfWebsiteHere",
        },
}

Create an unsigned token from the claims:

token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

Sign the token using a secure private key. In production make sure you use a real private key, preferably at least 256 bits in length:

signedToken, err := token.SignedString([]byte("secureSecretText"))

Now the signed token can be sent back to the client.

Validating a JWT

When the client makes a request to a protected endpoint we can verify the JWT is authentic using the following steps.

*Note: It is idiomatic to use the Authorization HTTP header:

Authorization: Bearer {jwt}

After receiving the JWT, validate the claims and verify the signature using the same private key:

token, err := jwt.ParseWithClaims(
        jwtFromHeader,
        &customClaims{},
        func(token *jwt.Token) (interface{}, error) {
                return []byte("secureSecretText"), nil 
        },
)

If the claims have been tampered with then the err variable will not be nil.

Parse the claims from the token:

claims, ok := token.Claims.(*customClaims)
if !ok {
        return errors.New("Couldn't parse claims")
}

Check if the token is expired:

if claims.ExpiresAt < time.Now().UTC().Unix() {
        return errors.New("JWT is expired")
}

You now know the username of the authenticated user!

username := claims.Username

For full examples take a look at the package’s tests.

Thanks For Reading!

Lane on Twitter: @wagslane

Lane on Dev.to: wagslane

Download Qvault: https://qvault.io

The post How To Build JWT’s in Go (Golang) appeared first on Qvault.



source https://qvault.io/2020/02/20/how-to-build-jwts-in-go-golang/?utm_source=rss&utm_medium=rss&utm_campaign=how-to-build-jwts-in-go-golang

Comments

Post a Comment

Popular posts from this blog

Why is Exclusive Or (XOR) Important in Cryptography?

Image
If you are getting into cryptography, or just trying to understand the fundamentals, you may have noticed that the exclusive-or operation is used quite often, especially in ciphers. What is XOR ( ⊕ )? XOR, or “exclusive or” operates on binary data. It returns true if both of its inputs are opposites (one false and one true), otherwise, it returns false. An example in go code would be something like: func exclusiveOr(a bool, b bool) bool { return a != b } XOR Cipher – The Perfect Cipher The XOR operation can be used as a simple cipher for encrypting and decrypting messages with a single key. This is known as symmetric encryption. It is interesting to note that if: The key is the same size as the message The key is kept secret and generated truly randomly Then the cipher is impossible to crack. This is known as a one time pad . However, a simple XOR shouldn’t be used in production due to the key length needing to be too long to be practical. Cipher Example A...
Read more

Base64 vs Base58 Encoding

Image
By Lane Wagner –  @wagslane  on Twitter Base64 is one of the most popular encoding formats for representing data. Have some binary data? Base64 encode it for convenient readability and parsing. Base58 is just another encoding format (with 58 characters instead of 64, and has gained popularity largely due to Bitcoin and other cryptocurrencies. When it comes to data encoding, there is typically a trade-off made between: Human Readability: Do humans have a good idea of what is being represented at a glance? Efficient data compression: How many bytes are used to represent the same data? Let’s rank Base58, Base64, and ASCII encoding against each other using these metrics! First: A Note on Binary All data is stored in a raw binary format on computers. These encoding formats (Base64, Base58, and ASCII) are just different ways of reading and writing binary data. For example, in Base64 the binary code 000000 represents the letter A , but in ASCII the binary 00000000 repres...
Read more

(Very) Basic Intro to Hash Functions (SHA-256, MD-5, etc)

Image
This is going to be a basic introduction to hash functions. I will assume most of my audience is here to gain an understanding of why hash functions are used and the basic idea of why they work. My goal is to explain it in a general sense, I will be omitting proofs and implementation details and instead focusing on the high-level principles. Why Use A Hash Function? Hash functions are used all over the internet in order to securely store passwords, find duplicate records, quickly store and retrieve data, and more. For example,  Qvault  uses hashes to extend master passwords into private encryption keys. A longer list of uses here:  https://en.wikipedia.org/wiki/Hash_function#Uses I want to focus on several important features of hash functions, arguably the most important features. Hash functions scramble data deterministically No matter the input, the output of a hash function always has the same size The original data can not be retrieved from the scrambled d...
Read more