go 微服务中的token的生成和验证

Posted 2022-11-07 有关于S27的故事

你看到这篇文章，应该清楚知道token的作用，直接来生成token，和验证token的代码

package main

import (
	"fmt"
	jwtmiddleware "github.com/auth0/go-jwt-middleware"
	"github.com/form3tech-oss/jwt-go"
	"io"
	"log"
	"net/http"
	"time"
)
// 私钥
const (
	appKey = "[e-mail]"
)

func main() 

	fmt.Println("start service......")
	defer fmt.Println("end of service....")
	// 校验用户密码获取token的路由
	http.HandleFunc("/token", TokenHandler)
	// 验证token的路由
	http.Handle("/", AuthMiddleware(http.HandlerFunc(ExampleHandler)))

	// 路由启动的端口号
	if err := http.ListenAndServe(":8080", nil); err != nil 
		log.Fatal(err)
	


// TokenHandler 验证请求发送的用户密码，合法则返回token
func TokenHandler(w http.ResponseWriter, r *http.Request) 

	w.Header().Add("Content-Type", "application/json")
	r.ParseForm()

	// 应该是 请求的用户密码和数据库的用户密码对比
	username := r.Form.Get("username")
	password := r.Form.Get("password")
	if username != "845264718" || password != "123456" 
		w.WriteHeader(http.StatusUnauthorized)
		io.WriteString(w, `"error":"invalid_credentials"`)
		return
	

	// 一个24小时有效的token
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims
		"user": username,
		"exp":  time.Now().Add(24*time.Hour * time.Duration(1)).Unix(),
		"iat":  time.Now().Unix(),
	)
	tokenString, err := token.SignedString([]byte(appKey))
	if err != nil 
		w.WriteHeader(http.StatusInternalServerError)
		io.WriteString(w, `"error":"token_generation_failed"`)
		return
	
	io.WriteString(w, `"token":"`+tokenString+`"`)
	return


// AuthMiddleware 中间件，用于校验token的合法性。无效则返回401。
func AuthMiddleware(next http.Handler) http.Handler 
	if len(appKey) == 0 
		log.Fatal("HTTP server unable to start, expected an APP_KEY for JWT auth")
	
	jwtMiddleware := jwtmiddleware.New(jwtmiddleware.Options
		ValidationKeyGetter: func(token *jwt.Token) (interface, error) 
			return []byte(appKey),nil
		,
		SigningMethod: jwt.SigningMethodHS256,
	)
	return jwtMiddleware.Handler(next)



func ExampleHandler(w http.ResponseWriter, r *http.Request) 
	w.Header().Add("Content-Type", "application/json")
	io.WriteString(w, `"status":"ok"`)

postman 模拟web发送请求严重账号密码，获取token

postman模拟web发送请求严重token的合法性