使用jwx库实现JOSE标准(JWA/JWE/JWK/JWS/JWT)的安全功能

jwx是一个功能强大的Golang库，用于实现JOSE标准(JWA/JWE/JWK/JWS/JWT)的安全功能。下面我将介绍如何使用这个库来实现常见的加密、签名和令牌功能。

安装

首先安装jwx库：

go get github.com/lestrrat-go/jwx/v2

JWT (JSON Web Token) 示例

创建JWT

package main

import (
	"fmt"
	"time"
	
	"github.com/lestrrat-go/jwx/v2/jwa"
	"github.com/lestrrat-go/jwx/v2/jwt"
)

func main() {
	// 创建JWT令牌
	token, err := jwt.NewBuilder().
		Issuer("my-issuer").
		Subject("user123").
		Audience([]string{"client1", "client2"}).
		IssuedAt(time.Now()).
		Expiration(time.Now().Add(time.Hour)).
		Claim("custom", "value").
		Build()
	if err != nil {
		fmt.Printf("failed to build token: %s\n", err)
		return
	}

	// 使用HMAC算法签名
	signed, err := jwt.Sign(token, jwt.WithKey(jwa.HS256, []byte("your-secret-key")))
	if err != nil {
		fmt.Printf("failed to sign token: %s\n", err)
		return
	}

	fmt.Printf("Signed JWT: %s\n", signed)
}

验证JWT

func verifyJWT(tokenStr string) {
	// 解析并验证JWT
	token, err := jwt.Parse([]byte(tokenStr), 
		jwt.WithVerify(true),
		jwt.WithKey(jwa.HS256, []byte("your-secret-key")),
	)
	if err != nil {
		fmt.Printf("failed to parse token: %s\n", err)
		return
	}

	// 获取声明
	fmt.Printf("Issuer: %s\n", token.Issuer())
	fmt.Printf("Subject: %s\n", token.Subject())
	if custom, ok := token.Get("custom"); ok {
		fmt.Printf("Custom claim: %v\n", custom)
	}
}

JWS (JSON Web Signature) 示例

创建JWS

package main

import (
	"fmt"
	
	"github.com/lestrrat-go/jwx/v2/jwa"
	"github.com/lestrrat-go/jwx/v2/jws"
)

func main() {
	payload := []byte("important message to sign")

	// 使用RSA私钥签名
	privateKey := `-----BEGIN PRIVATE KEY-----
... your private key here ...
-----END PRIVATE KEY-----`

	signed, err := jws.Sign(payload, jws.WithKey(jwa.RS256, []byte(privateKey)))
	if err != nil {
		fmt.Printf("failed to sign payload: %s\n", err)
		return
	}

	fmt.Printf("Signed JWS: %s\n", signed)
}

验证JWS

func verifyJWS(jwsStr string) {
	publicKey := `-----BEGIN PUBLIC KEY-----
... your public key here ...
-----END PUBLIC KEY-----`

	verified, err := jws.Verify([]byte(jwsStr), jws.WithKey(jwa.RS256, []byte(publicKey)))
	if err != nil {
		fmt.Printf("failed to verify JWS: %s\n", err)
		return
	}

	fmt.Printf("Verified payload: %s\n", verified)
}

JWE (JSON Web Encryption) 示例

加密数据

package main

import (
	"fmt"
	
	"github.com/lestrrat-go/jwx/v2/jwa"
	"github.com/lestrrat-go/jwx/v2/jwe"
)

func main() {
	payload := []byte("sensitive data to encrypt")

	// 使用RSA公钥加密
	publicKey := `-----BEGIN PUBLIC KEY-----
... your public key here ...
-----END PUBLIC KEY-----`

	encrypted, err := jwe.Encrypt(
		payload,
		jwe.WithKey(jwa.RSA_OAEP, []byte(publicKey)),
		jwe.WithContentEncryption(jwa.A256GCM),
	)
	if err != nil {
		fmt.Printf("failed to encrypt payload: %s\n", err)
		return
	}

	fmt.Printf("Encrypted JWE: %s\n", encrypted)
}

解密数据

func decryptJWE(jweStr string) {
	privateKey := `-----BEGIN PRIVATE KEY-----
... your private key here ...
-----END PRIVATE KEY-----`

	decrypted, err := jwe.Decrypt(
		[]byte(jweStr),
		jwe.WithKey(jwa.RSA_OAEP, []byte(privateKey)),
	)
	if err != nil {
		fmt.Printf("failed to decrypt JWE: %s\n", err)
		return
	}

	fmt.Printf("Decrypted payload: %s\n", decrypted)
}

JWK (JSON Web Key) 示例

生成和解析JWK

package main

import (
	"fmt"
	
	"github.com/lestrrat-go/jwx/v2/jwk"
)

func main() {
	// 生成RSA密钥对
	key, err := jwk.GenerateKey(jwk.WithKeyType(jwa.RSA))
	if err != nil {
		fmt.Printf("failed to generate key: %s\n", err)
		return
	}

	// 设置密钥ID
	_ = key.Set(jwk.KeyIDKey, "my-key-id")

	// 将密钥序列化为JSON
	jsonBuf, err := jwk.Encode(key)
	if err != nil {
		fmt.Printf("failed to encode key: %s\n", err)
		return
	}

	fmt.Printf("JWK: %s\n", jsonBuf)

	// 从JSON解析JWK
	parsedKey, err := jwk.ParseKey(jsonBuf)
	if err != nil {
		fmt.Printf("failed to parse key: %s\n", err)
		return
	}

	fmt.Printf("Parsed key type: %s\n", parsedKey.KeyType())
}

最佳实践

1. 密钥管理：永远不要在代码中硬编码密钥，使用环境变量或密钥管理系统
2. 算法选择：
   • 签名：优先选择ES256/ES384/ES512或PS256/PS384/PS512
   • 加密：优先选择RSA-OAEP-256或ECDH-ES+A256KW
3. 令牌有效期：总是设置合理的过期时间
4. 错误处理：正确处理所有错误，不要泄露敏感信息
5. 密钥轮换：实现密钥轮换机制，定期更新密钥

jwx库提供了丰富的功能来处理JOSE标准，上述示例展示了最常见的用例。根据你的具体需求，你可能需要查阅官方文档来了解更多高级功能。