Go is becoming very popular for backend web development, and JWT's are one of the most popular ways to handle authentication on API requests. In this article, we are going to go over the basics of JWT's and how to implement a secure authentication strategy in Go! What is a JWT? JSON Web Tokens are an open, industry standard method for representing claims securely between two parties. RFC 7519 More simply put, JWT's are encoded objects that have been signed by the server, verifying authenticity. JSON For example, when a user logs in to a website secured via JWTs, the flow should look something like this: The user sends a username and password to the server The server verifies username and password are correct The server creates a JSON object (aka claims) that looks like this: {"username":"wagslane"} The server encodes and signs the JSON object, creating a JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6IndhZ3NsYW5lIn0.ov6d8XtwQoKUwsYahk9UwH333NICElFSs6ag6pINyPQ The user's web client saves the JWT for later use When the user makes a request to a protected endpoint, it passes the JWT is along in an HTTP header The server checks the signature on the JWT to make sure the JWT was originally created by the same server The server reads the claims and gives permission to the request to operate as " " wagslane Create a JWT We are going to use a popular library for dealing with JSON Web Tokens's in Go, . Make sure you have the code cloned locally: jwt-go go get github.com/dgrijalva/jwt-go For simplicity, we are building a symmetric encryption scheme. This means we assume that the server that creates the JWTs will also be the only server that will be verifying them. First, define a struct that will be used to represent claims to identify our users: customClaims {
	Username jwt.StandardClaims
} type struct string `json:"username"` The struct contains useful fields like and . Now we will create some actual claims for the user that just logged in: jwt.StandardClaims expiry issuer name claims := customClaims{ username, jwt.StandardClaims{ , ,
	},
} Username: StandardClaims: ExpiresAt: 15000 Issuer: "nameOfWebsiteHere" Create an unsigned token from the claims: token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims) Sign the token using a secure private key. In production make sure you use a real private key, preferably at least 256 bits in length: signedToken, err := token.SignedString([] ( )) byte "secureSecretText" Now the signed token can be sent back to the client. Validating a JWT When the client makes a request to a protected endpoint we can verify the JWT is authentic using the following steps. * : It is idiomatic to use the Authorization HTTP header: Note Authorization: Bearer {jwt} After receiving the JWT, validate the claims and verify the signature using the same private key: token, err := jwt.ParseWithClaims(
	jwtFromHeader,
	&customClaims{}, { [] ( ), },
) func (token *jwt.Token) ( {}, error) interface return byte "secureSecretText" nil If the claims have been tampered with then the err variable will not be . nil Parse the claims from the token: claims, ok := token.Claims.(*customClaims) !ok { errors.New( )
} if return "Couldn't parse claims" Check if the token is expired: claims.ExpiresAt < time.Now().UTC().Unix() { errors.New( )
} if return "JWT is expired" You now know the username of the authenticated user! username := claims.Username For full examples take a look at the package's . tests Thanks For Reading! Lane on Twitter: @wagslane Lane on Dev.to: wagslane Download Qvault: https://qvault.io By Lane Wagner Previously published at https://qvault.io/2020/02/20/how-to-build-jwts-in-go-golang/

Flow

Twitter

2022 - HackerNoon Contributor of the Year - Algorithms

2022 - HackerNoon Contributor of the Year - Cryptography

2022 - HackerNoon Contributor of the Year - Github

2022 - HackerNoon Contributor of the Year - Job Hunting

2022 - HackerNoon Contributor of the Year - Mathematics

2022 - HackerNoon Contributor of the Year - Online Education

Coding Guru of 2022

Super Career Strategist of 2022

Learn to code on Boot.dev

Nominated for 2022 - HackerNoon Contributor of the Year - Algorithms

Nominated for 2022 - HackerNoon Contributor of the Year - Mathematics

Nominated for 2022 - HackerNoon Contributor of the Year - Cryptography

Nominated for Coding Guru of 2022

Nominated for 2022 - HackerNoon Contributor of the Year - Github

Nominated for 2022 - HackerNoon Contributor of the Year - Online Education

Nominated for 2022 - HackerNoon Contributor of the Year - Job Hunting

Nominated for Super Career Strategist of 2022

Too Long; Didn't Read

Discover Saakuru: Web3 Mass-Adoption with 0-FEES

How To Build JWT's in Go

How To Build JWT's in Go

Too Long; Didn't Read

People Mentioned

Company Mentioned

Coin Mentioned

Lane Wagner

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

How To Build JWT's in Go

Too Long; Didn't Read

People Mentioned

Company Mentioned

Coin Mentioned

Lane Wagner

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

RELATED STORIES