Introduction
In modern web development, secure and scalable authentication is crucial. JSON Web Tokens (JWT) have become the standard way to achieve this goal. In this blog post, we will explore what JWT is, how it works, and how to implement it in Golang.
What is JWT?
JSON Web Token (JWT) is a compact, URL-safe way of representing claims for securely transmitting claims between two parties. It is commonly used to authenticate and authorize users in APIs and distributed systems.
Structure of JWT
A JWT consists of three parts separated by dots (.):
<code>Header.Payload.Signature</code>
Example:
<code>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.reGQzG3OKdoIMWLDKOZ4TICJit3EW69cQE72E2CfzRE</code>
Each part is:
- Header: Specifies the token type (JWT) and signature algorithm (HS256).
<code>{ "alg": "HS256", "typ": "JWT" }</code>
- Payload: Contains claims (user data such as ID, role or name).
<code>{ "sub": "1234567890", "name": "John Doe", "admin": true, "iat": 1516239022 }</code>
- Signature: Uses a cryptographic signing process to ensure the integrity of the token. Let’s explore this in detail.
How to create a signature:
- Connect the encoded Header and Payload:
<code> base64UrlEncode(header) + "." + base64UrlEncode(payload)</code>
- Sign the result:
- Use a cryptographic signature algorithm (e.g., HMACSHA256, RS256) using a secret key or private key.
- Additional signature: The final JWT becomes
<code> header.payload.signature</code>
How JWT works
- The client sends login credentials to the server.
- If valid, the server will generate the JWT and return it to the client.
- Client stores JWT (e.g. in localStorage or cookie).
- For every request, the client includes the JWT in the Authorization header: Authorization: Bearer
- The server validates the JWT on every request.
- Recalculate the signature using the received Header and Payload.
- Compare the recalculated signature with the received signature.
Implementing JWT in Golang
Golang developers can leverage the excellent golang-jwt/jwt library to handle JWT. This library provides powerful functionality for creating, signing, and validating JWTs. You can find it here.
However, managing JWTs often requires repetitive tasks such as configuring signing methods, parsing tokens, and validating claims. To simplify this, I wrote a custom package to wrap the functionality of golang-jwt. You can view my package here. Here is an example of how to use my custom JWT package.
package main import ( "context" "fmt" "log" "time" "github.com/golang-jwt/jwt/v5" jwtutil "github.com/kittipat1413/go-common/util/jwt" ) type MyCustomClaims struct { jwt.RegisteredClaims UserID string `json:"uid"` } func main() { ctx := context.Background() signingKey := []byte("super-secret-key") manager, err := jwtutil.NewJWTManager(jwtutil.HS256, signingKey) if err != nil { log.Fatalf("Failed to create JWTManager: %v", err) } // Prepare custom claims claims := &MyCustomClaims{ RegisteredClaims: jwt.RegisteredClaims{ ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)), Issuer: "example-HS256", Subject: "example-subject", }, UserID: "abc123", } // Create the token tokenStringHS256, err := manager.CreateToken(ctx, claims) if err != nil { log.Fatalf("Failed to create token: %v", err) } fmt.Println("Generated Token:", tokenStringHS256) // Validate the token parsedClaims := &MyCustomClaims{} err = manager.ParseAndValidateToken(ctx, tokenStringHS256, parsedClaims) if err != nil { log.Fatalf("Failed to validate token: %v", err) } fmt.Printf("Token is valid! UserID: %s, Issuer: %s\n", parsedClaims.UserID, parsedClaims.Issuer) }You can browse the full implementation and documentation of my package on GitHub: here.
JWT Best Practices
- Use HTTPS: Always transfer tokens over a secure channel.
- Set expiration time: Include reasonable exp to limit token abuse.
- Protect your keys: Store your keys securely using environment variables or a key manager.
- Avoid using sensitive data in the payload: Include only non-critical information.
- Use refresh token: Pair a JWT with a refresh token to extend the session securely.
Conclusion ?
JWT is a powerful tool for secure, stateless authentication. The signature ensures the integrity and authenticity of the token, making JWT ideal for APIs and distributed systems. Using libraries like jwt-go you can easily implement JWT in your Golang project.
? Support my work ?
If you like my work, please consider buying me a coffee! Your support helps me continue to create valuable content and share knowledge. ?
The above is the detailed content of JWT Tokens in Golang: A Developer's Guide to Secure APIs. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Go compiles the program into a standalone binary by default, the main reason is static linking. 1. Simpler deployment: no additional installation of dependency libraries, can be run directly across Linux distributions; 2. Larger binary size: Including all dependencies causes file size to increase, but can be optimized through building flags or compression tools; 3. Higher predictability and security: avoid risks brought about by changes in external library versions and enhance stability; 4. Limited operation flexibility: cannot hot update of shared libraries, and recompile and deployment are required to fix dependency vulnerabilities. These features make Go suitable for CLI tools, microservices and other scenarios, but trade-offs are needed in environments where storage is restricted or relies on centralized management.

Goensuresmemorysafetywithoutmanualmanagementthroughautomaticgarbagecollection,nopointerarithmetic,safeconcurrency,andruntimechecks.First,Go’sgarbagecollectorautomaticallyreclaimsunusedmemory,preventingleaksanddanglingpointers.Second,itdisallowspointe

To create a buffer channel in Go, just specify the capacity parameters in the make function. The buffer channel allows the sending operation to temporarily store data when there is no receiver, as long as the specified capacity is not exceeded. For example, ch:=make(chanint,10) creates a buffer channel that can store up to 10 integer values; unlike unbuffered channels, data will not be blocked immediately when sending, but the data will be temporarily stored in the buffer until it is taken away by the receiver; when using it, please note: 1. The capacity setting should be reasonable to avoid memory waste or frequent blocking; 2. The buffer needs to prevent memory problems from being accumulated indefinitely in the buffer; 3. The signal can be passed by the chanstruct{} type to save resources; common scenarios include controlling the number of concurrency, producer-consumer models and differentiation

Go is ideal for system programming because it combines the performance of compiled languages ??such as C with the ease of use and security of modern languages. 1. In terms of file and directory operations, Go's os package supports creation, deletion, renaming and checking whether files and directories exist. Use os.ReadFile to read the entire file in one line of code, which is suitable for writing backup scripts or log processing tools; 2. In terms of process management, the exec.Command function of the os/exec package can execute external commands, capture output, set environment variables, redirect input and output flows, and control process life cycles, which are suitable for automation tools and deployment scripts; 3. In terms of network and concurrency, the net package supports TCP/UDP programming, DNS query and original sets.

In Go language, calling a structure method requires first defining the structure and the method that binds the receiver, and accessing it using a point number. After defining the structure Rectangle, the method can be declared through the value receiver or the pointer receiver; 1. Use the value receiver such as func(rRectangle)Area()int and directly call it through rect.Area(); 2. If you need to modify the structure, use the pointer receiver such as func(r*Rectangle)SetWidth(...), and Go will automatically handle the conversion of pointers and values; 3. When embedding the structure, the method of embedded structure will be improved, and it can be called directly through the outer structure; 4. Go does not need to force use getter/setter,

In Go, an interface is a type that defines behavior without specifying implementation. An interface consists of method signatures, and any type that implements these methods automatically satisfy the interface. For example, if you define a Speaker interface that contains the Speak() method, all types that implement the method can be considered Speaker. Interfaces are suitable for writing common functions, abstract implementation details, and using mock objects in testing. Defining an interface uses the interface keyword and lists method signatures, without explicitly declaring the type to implement the interface. Common use cases include logs, formatting, abstractions of different databases or services, and notification systems. For example, both Dog and Robot types can implement Speak methods and pass them to the same Anno

In Go language, string operations are mainly implemented through strings package and built-in functions. 1.strings.Contains() is used to determine whether a string contains a substring and returns a Boolean value; 2.strings.Index() can find the location where the substring appears for the first time, and if it does not exist, it returns -1; 3.strings.ReplaceAll() can replace all matching substrings, and can also control the number of replacements through strings.Replace(); 4.len() function is used to obtain the length of the bytes of the string, but when processing Unicode, you need to pay attention to the difference between characters and bytes. These functions are often used in scenarios such as data filtering, text parsing, and string processing.

TheGoiopackageprovidesinterfaceslikeReaderandWritertohandleI/Ooperationsuniformlyacrosssources.1.io.Reader'sReadmethodenablesreadingfromvarioussourcessuchasfilesorHTTPresponses.2.io.Writer'sWritemethodfacilitateswritingtodestinationslikestandardoutpu
