Golang JWT认证中间件实现

下面我将介绍如何使用Golang实现一个JWT认证中间件库，并提供完整的示例代码。

1. 基本实现

首先我们需要安装必要的依赖：

go get github.com/golang-jwt/jwt/v5

1.1 核心代码实现

package jwt_auth

import (
	"errors"
	"net/http"
	"strings"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

// 自定义Claims结构
type CustomClaims struct {
	UserID   int    `json:"user_id"`
	Username string `json:"username"`
	jwt.RegisteredClaims
}

// JWT配置
type Config struct {
	SecretKey       string        // 密钥
	ExpirationTime  time.Duration // 过期时间
	SigningMethod   string        // 签名方法 HS256/HS384/HS512
	TokenLookup     string        // token查找位置 header:<name>
	AuthScheme      string        // 认证方案 Bearer
}

// 默认配置
var defaultConfig = Config{
	SecretKey:      "your-secret-key",
	ExpirationTime: 24 * time.Hour,
	SigningMethod:  "HS256",
	TokenLookup:    "header:Authorization",
	AuthScheme:     "Bearer",
}

// JWT认证中间件
type JWTAuth struct {
	config Config
}

// 创建新的JWT认证实例
func New(config ...Config) *JWTAuth {
	cfg := defaultConfig
	if len(config) > 0 {
		cfg = config[0]
	}
	return &JWTAuth{config: cfg}
}

// 生成Token
func (j *JWTAuth) GenerateToken(userID int, username string) (string, error) {
	claims := CustomClaims{
		UserID:   userID,
		Username: username,
		RegisteredClaims: jwt.RegisteredClaims{
			ExpiresAt: jwt.NewNumericDate(time.Now().Add(j.config.ExpirationTime)),
			IssuedAt:  jwt.NewNumericDate(time.Now()),
			Issuer:    "jwt-auth",
		},
	}

	method := jwt.GetSigningMethod(j.config.SigningMethod)
	token := jwt.NewWithClaims(method, claims)
	return token.SignedString([]byte(j.config.SecretKey))
}

// 解析Token
func (j *JWTAuth) ParseToken(tokenString string) (*CustomClaims, error) {
	token, err := jwt.ParseWithClaims(tokenString, &CustomClaims{}, func(token *jwt.Token) (interface{}, error) {
		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
			return nil, jwt.ErrSignatureInvalid
		}
		return []byte(j.config.SecretKey), nil
	})

	if err != nil {
		return nil, err
	}

	if claims, ok := token.Claims.(*CustomClaims); ok && token.Valid {
		return claims, nil
	}

	return nil, errors.New("invalid token")
}

// 中间件函数
func (j *JWTAuth) Middleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// 从请求中提取token
		token, err := j.extractToken(r)
		if err != nil {
			http.Error(w, err.Error(), http.StatusUnauthorized)
			return
		}

		// 解析token
		claims, err := j.ParseToken(token)
		if err != nil {
			http.Error(w, "invalid token", http.StatusUnauthorized)
			return
		}

		// 将claims信息存入上下文
		ctx := r.Context()
		ctx = contextWithUserID(ctx, claims.UserID)
		ctx = contextWithUsername(ctx, claims.Username)
		r = r.WithContext(ctx)

		next.ServeHTTP(w, r)
	})
}

// 从请求中提取token
func (j *JWTAuth) extractToken(r *http.Request) (string, error) {
	parts := strings.Split(j.config.TokenLookup, ":")
	if len(parts) != 2 {
		return "", errors.New("invalid token lookup format")
	}

	switch parts[0] {
	case "header":
		return j.extractTokenFromHeader(r, parts[1])
	case "query":
		return j.extractTokenFromQuery(r, parts[1])
	case "cookie":
		return j.extractTokenFromCookie(r, parts[1])
	default:
		return "", errors.New("unsupported token lookup")
	}
}

// 从header中提取token
func (j *JWTAuth) extractTokenFromHeader(r *http.Request, key string) (string, error) {
	authHeader := r.Header.Get(key)
	if authHeader == "" {
		return "", errors.New("authorization header is missing")
	}

	parts := strings.SplitN(authHeader, " ", 2)
	if !(len(parts) == 2 && parts[0] == j.config.AuthScheme) {
		return "", errors.New("invalid authorization header format")
	}

	return parts[1], nil
}

// 从query参数中提取token
func (j *JWTAuth) extractTokenFromQuery(r *http.Request, key string) (string, error) {
	token := r.URL.Query().Get(key)
	if token == "" {
		return "", errors.New("token query parameter is missing")
	}
	return token, nil
}

// 从cookie中提取token
func (j *JWTAuth) extractTokenFromCookie(r *http.Request, key string) (string, error) {
	cookie, err := r.Cookie(key)
	if err != nil {
		return "", errors.New("token cookie is missing")
	}
	return cookie.Value, nil
}

1.2 上下文处理

// 上下文键类型
type contextKey string

const (
	userIDKey   contextKey = "user_id"
	usernameKey contextKey = "username"
)

// 将userID存入上下文
func contextWithUserID(ctx context.Context, userID int) context.Context {
	return context.WithValue(ctx, userIDKey, userID)
}

// 从上下文中获取userID
func UserIDFromContext(ctx context.Context) (int, bool) {
	userID, ok := ctx.Value(userIDKey).(int)
	return userID, ok
}

// 将username存入上下文
func contextWithUsername(ctx context.Context, username string) context.Context {
	return context.WithValue(ctx, usernameKey, username)
}

// 从上下文中获取username
func UsernameFromContext(ctx context.Context) (string, bool) {
	username, ok := ctx.Value(usernameKey).(string)
	return username, ok
}

2. 使用示例

2.1 初始化并使用中间件

package main

import (
	"fmt"
	"net/http"
	"time"
	
	"yourmodule/jwt_auth"
)

func main() {
	// 初始化JWT认证
	jwtAuth := jwt_auth.New(jwt_auth.Config{
		SecretKey:      "your-very-secret-key",
		ExpirationTime: 24 * time.Hour,
	})

	// 受保护的路由
	protectedHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		userID, ok := jwt_auth.UserIDFromContext(r.Context())
		if !ok {
			http.Error(w, "user ID not found", http.StatusUnauthorized)
			return
		}
		
		username, _ := jwt_auth.UsernameFromContext(r.Context())
		fmt.Fprintf(w, "Welcome, %s (ID: %d)! This is a protected route.", username, userID)
	})

	// 登录路由
	http.HandleFunc("/login", func(w http.ResponseWriter, r *http.Request) {
		// 这里应该是你的用户认证逻辑
		// 假设认证成功，我们生成token
		userID := 123
		username := "john_doe"
		
		token, err := jwtAuth.GenerateToken(userID, username)
		if err != nil {
			http.Error(w, "failed to generate token", http.StatusInternalServerError)
			return
		}
		
		w.Header().Set("Content-Type", "application/json")
		fmt.Fprintf(w, `{"token": "%s"}`, token)
	})

	// 应用JWT中间件到受保护的路由
	http.Handle("/protected", jwtAuth.Middleware(protectedHandler))

	fmt.Println("Server started on :8080")
	http.ListenAndServe(":8080", nil)
}

2.2 测试

1. 首先访问 /login 获取token
2. 然后访问 /protected 并在Header中添加：

   Authorization: Bearer <your-token>
   

3. 功能扩展

这个基础实现可以进一步扩展：

1. 刷新Token：添加刷新token的机制
2. 黑名单：实现token黑名单用于登出功能
3. 多角色支持：在claims中添加角色信息
4. 性能优化：添加token缓存

这个JWT中间件实现提供了基本的认证功能，可以根据项目需求进行进一步定制和扩展。