go 微服务中的token的生成和验证

Posted 2021-10-17 老虎中的小白Gentle

你看到这篇文章，应该清楚知道token的作用，直接来生成token，和验证token的代码

package main

import (
	"fmt"
	jwtmiddleware "github.com/auth0/go-jwt-middleware"
	"github.com/form3tech-oss/jwt-go"
	"io"
	"log"
	"net/http"
	"time"
)
// 私钥
const (
	appKey = "[e-mail]"
)

func main() {

	fmt.Println("start service......")
	defer fmt.Println("end of service....")
	// 校验用户密码获取token的路由
	http.HandleFunc("/token", TokenHandler)
	// 验证token的路由
	http.Handle("/", AuthMiddleware(http.HandlerFunc(ExampleHandler)))

	// 路由启动的端口号
	if err := http.ListenAndServe(":8080", nil); err != nil {
		log.Fatal(err)
	}
}

// TokenHandler 验证请求发送的用户密码，合法则返回token
func TokenHandler(w http.ResponseWriter, r *http.Request) {

	w.Header().Add("Content-Type", "application/json")
	r.ParseForm()

	// 应该是 请求的用户密码和数据库的用户密码对比
	username := r.Form.Get("username")
	password := r.Form.Get("password")
	if username != "845264718" || password != "123456" {
		w.WriteHeader(http.StatusUnauthorized)
		io.WriteString(w, `{"error":"invalid_credentials"}`)
		return
	}

	// 一个24小时有效的token
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
		"user": username,
		"exp":  time.Now().Add(24*time.Hour * time.Duration(1)).Unix(),
		"iat":  time.Now().Unix(),
	})
	tokenString, err := token.SignedString([]byte(appKey))
	if err != nil {
		w.WriteHeader(http.StatusInternalServerError)
		io.WriteString(w, `{"error":"token_generation_failed"}`)
		return
	}
	io.WriteString(w, `{"token":"`+tokenString+`"}`)
	return
}

// AuthMiddleware 中间件，用于校验token的合法性。无效则返回401。
func AuthMiddleware(next http.Handler) http.Handler {
	if len(appKey) == 0 {
		log.Fatal("HTTP server unable to start, expected an APP_KEY for JWT auth")
	}
	jwtMiddleware := jwtmiddleware.New(jwtmiddleware.Options{
		ValidationKeyGetter: func(token *jwt.Token) (interface{}, error) {
			return []byte(appKey),nil
		},
		SigningMethod: jwt.SigningMethodHS256,
	})
	return jwtMiddleware.Handler(next)
}


func ExampleHandler(w http.ResponseWriter, r *http.Request) {
	w.Header().Add("Content-Type", "application/json")
	io.WriteString(w, `{"status":"ok"}`)
}

postman 模拟web发送请求严重账号密码，获取token

postman模拟web发送请求严重token的合法性