Golang中如何用Gin实现Bearer Token认证

在Gin中实现Bearer Token认证需要结合中间件和数据库验证。以下是完整的实现方案：

package main

import (
    "crypto/rand"
    "encoding/hex"
    "net/http"
    "strings"
    "time"
    
    "github.com/gin-gonic/gin"
    "golang.org/x/crypto/bcrypt"
    "gorm.io/driver/postgres"
    "gorm.io/gorm"
)

type User struct {
    ID           uint      `gorm:"primaryKey"`
    Username     string    `gorm:"unique;not null"`
    PasswordHash string    `gorm:"not null"`
    CreatedAt    time.Time
}

type Token struct {
    ID        uint      `gorm:"primaryKey"`
    UserID    uint      `gorm:"not null"`
    Token     string    `gorm:"unique;not null"`
    ExpiresAt time.Time `gorm:"not null"`
    CreatedAt time.Time
}

var db *gorm.DB

func main() {
    // 初始化数据库连接
    dsn := "host=localhost user=postgres password=secret dbname=authdb port=5432 sslmode=disable"
    var err error
    db, err = gorm.Open(postgres.Open(dsn), &gorm.Config{})
    if err != nil {
        panic("failed to connect database")
    }
    
    // 自动迁移表结构
    db.AutoMigrate(&User{}, &Token{})
    
    r := gin.Default()
    
    // 用户注册
    r.POST("/register", registerHandler)
    
    // 用户登录，返回Bearer Token
    r.POST("/login", loginHandler)
    
    // 需要认证的路由组
    authGroup := r.Group("/api")
    authGroup.Use(authMiddleware())
    {
        authGroup.GET("/resource", getResourceHandler)
        authGroup.POST("/logout", logoutHandler)
    }
    
    r.Run(":8080")
}

// 用户注册处理器
func registerHandler(c *gin.Context) {
    var req struct {
        Username string `json:"username" binding:"required"`
        Password string `json:"password" binding:"required"`
    }
    
    if err := c.ShouldBindJSON(&req); err != nil {
        c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
        return
    }
    
    // 检查用户是否已存在
    var existingUser User
    if result := db.Where("username = ?", req.Username).First(&existingUser); result.RowsAffected > 0 {
        c.JSON(http.StatusConflict, gin.H{"error": "username already exists"})
        return
    }
    
    // 使用bcrypt哈希密码
    hashedPassword, err := bcrypt.GenerateFromPassword([]byte(req.Password), bcrypt.DefaultCost)
    if err != nil {
        c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to hash password"})
        return
    }
    
    // 创建用户
    user := User{
        Username:     req.Username,
        PasswordHash: string(hashedPassword),
        CreatedAt:    time.Now(),
    }
    
    if err := db.Create(&user).Error; err != nil {
        c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create user"})
        return
    }
    
    c.JSON(http.StatusCreated, gin.H{
        "message": "user created successfully",
        "user_id": user.ID,
    })
}

// 用户登录处理器
func loginHandler(c *gin.Context) {
    var req struct {
        Username string `json:"username" binding:"required"`
        Password string `json:"password" binding:"required"`
    }
    
    if err := c.ShouldBindJSON(&req); err != nil {
        c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
        return
    }
    
    // 查找用户
    var user User
    if err := db.Where("username = ?", req.Username).First(&user).Error; err != nil {
        c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
        return
    }
    
    // 验证密码
    if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(req.Password)); err != nil {
        c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid credentials"})
        return
    }
    
    // 生成Bearer Token
    tokenString, err := generateToken(32)
    if err != nil {
        c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to generate token"})
        return
    }
    
    // 保存Token到数据库（设置24小时过期）
    token := Token{
        UserID:    user.ID,
        Token:     tokenString,
        ExpiresAt: time.Now().Add(24 * time.Hour),
        CreatedAt: time.Now(),
    }
    
    if err := db.Create(&token).Error; err != nil {
        c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to save token"})
        return
    }
    
    c.JSON(http.StatusOK, gin.H{
        "token":      tokenString,
        "token_type": "Bearer",
        "expires_in": 86400, // 24小时秒数
        "user_id":    user.ID,
    })
}

// Bearer Token认证中间件
func authMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        authHeader := c.GetHeader("Authorization")
        if authHeader == "" {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "authorization header required"})
            c.Abort()
            return
        }
        
        // 检查Bearer Token格式
        parts := strings.Split(authHeader, " ")
        if len(parts) != 2 || parts[0] != "Bearer" {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid authorization format"})
            c.Abort()
            return
        }
        
        tokenString := parts[1]
        
        // 验证Token
        var token Token
        if err := db.Where("token = ? AND expires_at > ?", tokenString, time.Now()).First(&token).Error; err != nil {
            c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid or expired token"})
            c.Abort()
            return
        }
        
        // 将用户ID存储到上下文中供后续使用
        c.Set("user_id", token.UserID)
        c.Next()
    }
}

// 受保护资源处理器
func getResourceHandler(c *gin.Context) {
    userID, exists := c.Get("user_id")
    if !exists {
        c.JSON(http.StatusInternalServerError, gin.H{"error": "user context not found"})
        return
    }
    
    // 这里可以根据userID获取用户信息
    var user User
    if err := db.First(&user, userID).Error; err != nil {
        c.JSON(http.StatusInternalServerError, gin.H{"error": "user not found"})
        return
    }
    
    c.JSON(http.StatusOK, gin.H{
        "data": "protected resource data",
        "user": gin.H{
            "id":       user.ID,
            "username": user.Username,
        },
    })
}

// 登出处理器
func logoutHandler(c *gin.Context) {
    authHeader := c.GetHeader("Authorization")
    parts := strings.Split(authHeader, " ")
    
    if len(parts) == 2 && parts[0] == "Bearer" {
        // 从数据库中删除或标记Token为过期
        db.Where("token = ?", parts[1]).Delete(&Token{})
    }
    
    c.JSON(http.StatusOK, gin.H{"message": "logged out successfully"})
}

// 生成随机Token
func generateToken(length int) (string, error) {
    bytes := make([]byte, length)
    if _, err := rand.Read(bytes); err != nil {
        return "", err
    }
    return hex.EncodeToString(bytes), nil
}

这个实现包含以下关键部分：

1. 用户注册：使用bcrypt哈希密码并存储到PostgreSQL
2. 用户登录：验证密码后生成Bearer Token并存储到数据库
3. 认证中间件：验证Authorization头中的Bearer Token
4. Token管理：Token有过期时间，支持登出功能
5. 上下文传递：通过Gin的上下文传递用户信息

使用示例：

# 注册用户
curl -X POST http://localhost:8080/register \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser","password":"testpass"}'

# 登录获取Token
curl -X POST http://localhost:8080/login \
  -H "Content-Type: application/json" \
  -d '{"username":"testuser","password":"testpass"}'

# 访问受保护资源
curl -X GET http://localhost:8080/api/resource \
  -H "Authorization: Bearer <your_token_here>"

# 登出
curl -X POST http://localhost:8080/api/logout \
  -H "Authorization: Bearer <your_token_here>"

这个方案解决了内存存储Token的问题，使用数据库持久化存储，支持用户注册、登录、Token验证和登出完整流程。