使用go-guardian实现现代API和Web认证

go-guardian是一个强大的Go语言认证库，专门为现代API和Web应用程序设计。它支持多种认证策略，包括基本认证、JWT、OAuth2等，并提供了灵活的中间件集成方式。

安装go-guardian

go get github.com/shaj13/go-guardian/v2

基本使用示例

1. 基本认证

package main

import (
	"fmt"
	"net/http"
	
	"github.com/shaj13/go-guardian/v2/auth"
	"github.com/shaj13/go-guardian/v2/auth/strategies/basic"
	"github.com/shaj13/go-guardian/v2/auth/strategies/union"
)

func main() {
	// 创建认证策略
	strategy := basic.New(validateUser, "example-realm")

	// 创建HTTP服务器
	http.HandleFunc("/protected", middleware(strategy, protectedHandler))
	fmt.Println("Server started at :8080")
	http.ListenAndServe(":8080", nil)
}

// 验证用户凭据
func validateUser(ctx context.Context, r *http.Request, userName, password string) (auth.Info, error) {
	// 这里应该是从数据库或其他存储中验证用户
	if userName == "admin" && password == "admin123" {
		return auth.NewDefaultUser("admin", "1", nil, nil), nil
	}
	return nil, fmt.Errorf("invalid credentials")
}

// 中间件函数
func middleware(strategy union.Strategy, next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		_, user, err := strategy.AuthenticateRequest(r)
		if err != nil {
			code := http.StatusUnauthorized
			http.Error(w, http.StatusText(code), code)
			return
		}
		
		// 将用户信息存入上下文
		r = auth.RequestWithUser(user, r)
		next(w, r)
	}
}

// 受保护的处理程序
func protectedHandler(w http.ResponseWriter, r *http.Request) {
	user := auth.UserFromCtx(r.Context())
	fmt.Fprintf(w, "Welcome %s\n", user.GetUserName())
}

2. JWT认证

package main

import (
	"fmt"
	"net/http"
	"time"
	
	"github.com/shaj13/go-guardian/v2/auth"
	"github.com/shaj13/go-guardian/v2/auth/strategies/jwt"
	"github.com/shaj13/go-guardian/v2/auth/strategies/union"
	"github.com/shaj13/go-guardian/v2/auth/strategies/token"
)

var authenticator union.Union

func main() {
	// 设置JWT策略
	secret := []byte("your-secret-key")
	opts := []jwt.Option{
		jwt.SetExpDuration(time.Hour),
		jwt.SetSignatureAlgorithm(jwt.HS256),
	}
	
	jwtStrategy := jwt.New(secret, opts...)
	authenticator = union.New(jwtStrategy)
	
	// 登录路由
	http.HandleFunc("/login", loginHandler)
	
	// 受保护路由
	http.HandleFunc("/protected", middleware(authenticator, protectedHandler))
	
	fmt.Println("Server started at :8080")
	http.ListenAndServe(":8080", nil)
}

func loginHandler(w http.ResponseWriter, r *http.Request) {
	// 验证用户凭据
	user := auth.NewDefaultUser("admin", "1", nil, nil)
	
	// 生成JWT令牌
	token, err := jwt.IssueAccessToken(user, []byte("your-secret-key"))
	if err != nil {
		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	
	// 返回令牌给客户端
	w.Write([]byte(token))
}

func middleware(strategy union.Union, next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		_, user, err := strategy.AuthenticateRequest(r)
		if err != nil {
			code := http.StatusUnauthorized
			http.Error(w, http.StatusText(code), code)
			return
		}
		
		r = auth.RequestWithUser(user, r)
		next(w, r)
	}
}

func protectedHandler(w http.ResponseWriter, r *http.Request) {
	user := auth.UserFromCtx(r.Context())
	fmt.Fprintf(w, "Welcome %s\n", user.GetUserName())
}

3. 多策略组合认证

package main

import (
	"fmt"
	"net/http"
	"time"
	
	"github.com/shaj13/go-guardian/v2/auth"
	"github.com/shaj13/go-guardian/v2/auth/strategies/basic"
	"github.com/shaj13/go-guardian/v2/auth/strategies/jwt"
	"github.com/shaj13/go-guardian/v2/auth/strategies/union"
)

func main() {
	// 创建基本认证策略
	basicStrategy := basic.New(validateUser, "example-realm")
	
	// 创建JWT策略
	secret := []byte("your-secret-key")
	jwtOpts := []jwt.Option{
		jwt.SetExpDuration(time.Hour * 24),
		jwt.SetSignatureAlgorithm(jwt.HS256),
	}
	jwtStrategy := jwt.New(secret, jwtOpts...)
	
	// 组合策略
	authenticator := union.New(basicStrategy, jwtStrategy)
	
	http.HandleFunc("/protected", middleware(authenticator, protectedHandler))
	fmt.Println("Server started at :8080")
	http.ListenAndServe(":8080", nil)
}

// 其他函数与前面示例相同...

高级特性

1. 缓存策略

import (
	"github.com/shaj13/go-guardian/v2/auth"
	"github.com/shaj13/go-guardian/v2/auth/strategies/basic"
	"github.com/shaj13/go-guardian/v2/auth/strategies/union"
	"github.com/shaj13/go-guardian/v2/auth/strategies/cache"
)

func main() {
	// 创建基本策略
	basicStrategy := basic.New(validateUser, "example-realm")
	
	// 添加缓存
	cacheStrategy := cache.New(basicStrategy, cache.LRU(1000))
	
	// 组合策略
	authenticator := union.New(cacheStrategy)
	
	// 其他代码...
}

2. 自定义令牌解析

func middleware(strategy union.Union, next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		// 从自定义位置获取令牌
		token := r.Header.Get("X-Auth-Token")
		if token == "" {
			token = r.URL.Query().Get("token")
		}
		
		// 创建临时请求进行认证
		tmpReq := r.Clone(context.Background())
		if token != "" {
			tmpReq.Header.Set("Authorization", "Bearer "+token)
		}
		
		_, user, err := strategy.AuthenticateRequest(tmpReq)
		if err != nil {
			code := http.StatusUnauthorized
			http.Error(w, http.StatusText(code), code)
			return
		}
		
		r = auth.RequestWithUser(user, r)
		next(w, r)
	}
}

最佳实践

1. 生产环境应使用HTTPS保护认证信息
2. JWT密钥应足够复杂并定期轮换
3. 令牌过期时间应根据应用场景合理设置
4. 敏感路由应考虑添加速率限制
5. 用户权限应结合RBAC或ABAC模型实现细粒度控制

go-guardian提供了丰富的功能和灵活的扩展性，可以满足现代Web应用和API的各种认证需求。通过组合不同的策略，你可以轻松构建出既安全又易于维护的认证系统。