一文详解如何在Golang中实现JWT认证与授权

package main
 
import (
    "github.com/dgrijalva/jwt-go"
    "time"
    "log"
)
 
// 密钥用于签名和验证JWT
var jwtKey = []byte("secret")
 
// 用户信息结构体
type Claims struct {
    Username string `json:"username"`
    jwt.StandardClaims
}
 
// 生成JWT
func GenerateJWT(username string) (string, error) {
    expirationTime := time.Now().Add(1 * time.Hour) // 设置JWT过期时间为1小时
    claims := &Claims{
        Username: username,
        StandardClaims: jwt.StandardClaims{
            ExpiresAt: expirationTime.Unix(),
        },
    }
 
    // 创建一个新的JWT对象，使用HMAC SHA256算法签名
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 
    // 使用密钥签名并返回生成的JWT字符串
    return token.SignedString(jwtKey)
}

// 解析JWT并返回用户名
func ParseJWT(tokenStr string) (string, error) {
    claims := &Claims{}
    token, err := jwt.ParseWithClaims(tokenStr, claims, func(token *jwt.Token) (interface{}, error) {
        // 返回签名时使用的密钥
        return jwtKey, nil
    })
 
    if err != nil {
        return "", err
    }
 
    if !token.Valid {
        return "", err
    }
 
    return claims.Username, nil
}

package main
 
import (
    "github.com/gin-gonic/gin"
    "net/http"
)
 
// 假设的用户数据，实际应用中应使用数据库
var users = map[string]string{
    "user1": "password1",
    "user2": "password2",
}
 
func main() {
    r := gin.Default()
 
    // 登录接口
    r.POST("/login", func(c *gin.Context) {
        var loginData map[string]string
        if err := c.ShouldBindJSON(&loginData); err != nil {
            c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid input"})
            return
        }
 
        username, password := loginData["username"], loginData["password"]
 
        // 验证用户名和密码
        if correctPassword, exists := users[username]; exists && correctPassword == password {
            // 生成JWT
            token, err := GenerateJWT(username)
            if err != nil {
                c.JSON(http.StatusInternalServerError, gin.H{"error": "Could not generate token"})
                return
            }
 
            c.JSON(http.StatusOK, gin.H{"token": token})
        } else {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid username or password"})
        }
    })
 
    r.Run(":8080")
}

// JWT验证中间件
func JWTMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        // 获取Authorization头部
        tokenStr := c.GetHeader("Authorization")
        if tokenStr == "" {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Missing token"})
            c.Abort()
            return
        }
 
        // 解析JWT并获取用户名
        username, err := ParseJWT(tokenStr)
        if err != nil {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token"})
            c.Abort()
            return
        }
 
        // 将用户名添加到上下文中，以便后续使用
        c.Set("username", username)
        c.Next()
    }
}
 
func main() {
    r := gin.Default()
 
    // 登录接口
    r.POST("/login", func(c *gin.Context) {
        var loginData map[string]string
        if err := c.ShouldBindJSON(&loginData); err != nil {
            c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid input"})
            return
        }
 
        username, password := loginData["username"], loginData["password"]
 
        if correctPassword, exists := users[username]; exists && correctPassword == password {
            token, err := GenerateJWT(username)
            if err != nil {
                c.JSON(http.StatusInternalServerError, gin.H{"error": "Could not generate token"})
                return
            }
 
            c.JSON(http.StatusOK, gin.H{"token": token})
        } else {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid username or password"})
        }
    })
 
    // 受保护的路由，必须通过JWT验证
    authorized := r.Group("/protected")
    authorized.Use(JWTMiddleware())
    authorized.GET("/hello", func(c *gin.Context) {
        username := c.MustGet("username").(string)
        c.JSON(http.StatusOK, gin.H{
            "message": "Hello, " + username,
        })
    })
 
    r.Run(":8080")
}