Golang has been a popular language over the past few years known for it's simplicity and great out-of-the-box support for building web applications and for concurrency heavy processing. Similarly, JWT (JSON Web Tokens) are turning into an increasingly popular way of authenticating users. In this post I shall go over how to create an authentication middleware for Golang that can restrict certain parts of your web app to require authentication.
You can also apply this pattern for creation of middlewares to make any middleware that does anything you want to.
If you aren't familiar with JWTs, https://jwt.io/ is a great resource to get familiar with them. Basically, a JWT is a token included in the
AuthorizationThe scope of this article is limited to creating a middleware in Golang to check the validity of a JWT in an incoming request. Generation of JWTs are a separate process and I will not be describing how to do that here.
Setting up the web app
I'm using a simple Golang web app that provides a single API endpoint -
/pingpackage main
import (
"log"
"net/http"
)
func pong(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
w.Write([]byte("pong"))
}
func main() {
http.Handle("/ping", http.HandlerFunc(pong))
log.Fatal(http.ListenAndServe(":8080", nil))
}
Here's a quick breakdown of what this does:
The main function registers
pong/pingpongHandleHandlerHandlerFuncSo now if you run this with
go run main.gomain.gohttp://localhost:8080/pingpongNow I want to protect the
/pingCreating a middleware
A middleware for our HTTP server should be a function that takes in a function that implements the
http.Handlerhttp.HandlerThis concept should be familiar for anyone who has used JavaScript closures, Python decorators or functional programming of some kind. But essentially, it is a function that takes a function and adds additional functionality to it.
But wait - the handler function we just wrote,
ponghttpHandlerServeHTTPhttpHandlerFuncResponseWriter*RequestHandlerAt this point it's easy to get confused between these 4 things in the
http http.HandlerServeHTTPhttp.HandlerFuncpongHandlerhttp.HandleFunchttp.HandleHandleFuncHandlerLet's create the structure of a basic middleware:
func middleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// Do stuff
next.ServeHTTP(w, r)
})
}As you can see, we get the request and can do anything we want with it before calling the handler function we created earlier, which is passed to our middleware as
nextHandlerFuncHandlerNow you can have your middleware do whatever you want with the incoming request. What I want to do is to validate the JWT in the
AuthorizationauthHeader := strings.Split(r.Header.Get("Authorization"), "Bearer ")
if len(authHeader) != 2 {
fmt.Println("Malformed token")
w.WriteHeader(http.StatusUnauthorized)
w.Write([]byte("Malformed Token"))
}This takes the JWT token from the
AuthorizationThe expected format of the header is
Bearer <token>If the token is indeed present, we'll need to decode it. For this I'm using the
go-jwtgo get github.com/dgrijalva/jwt-goelse {
jwtToken := authHeader[1]
token, err := jwt.Parse(jwtToken, func(token *jwt.Token) (interface{}, error) {
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
}
return []byte(SECRETKEY), nil
})
if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
ctx := context.WithValue(r.Context(), "props", claims)
// Access context values in handlers like this
// props, _ := r.Context().Value("props").(jwt.MapClaims)
next.ServeHTTP(w, r.WithContext(ctx))
} else {
fmt.Println(err)
w.WriteHeader(http.StatusUnauthorized)
w.Write([]byte("Unauthorized"))
}
}We use
jwt.ParseNote that you have to replace the
SECRETKEYThen we obtain the claims from the token. The claims are whatever values that have been encoded in the JWT. If the decoding fails, this means the token has been corrupt or tampered with, and we return an unauthorized status.
If the decoding was successful, we create a variable
ctxContextFinally we change our earlier code to wrap the handler function in the middleware.
http.Handle("/ping", middleware(http.HandlerFunc(pong)))The complete code looks like this:
package main
import (
"context"
"fmt"
"log"
"net/http"
"strings"
"github.com/dgrijalva/jwt-go"
)
func middleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
authHeader := strings.Split(r.Header.Get("Authorization"), "Bearer ")
if len(authHeader) != 2 {
fmt.Println("Malformed token")
w.WriteHeader(http.StatusUnauthorized)
w.Write([]byte("Malformed Token"))
} else {
jwtToken := authHeader[1]
token, err := jwt.Parse(jwtToken, func(token *jwt.Token) (interface{}, error) {
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
}
return []byte(SECRETKEY), nil
})
if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
ctx := context.WithValue(r.Context(), "props", claims)
// Access context values in handlers like this
// props, _ := r.Context().Value("props").(jwt.MapClaims)
next.ServeHTTP(w, r.WithContext(ctx))
} else {
fmt.Println(err)
w.WriteHeader(http.StatusUnauthorized)
w.Write([]byte("Unauthorized"))
}
}
})
}
func pong(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
w.Write([]byte("pong"))
}
func main() {
http.Handle("/ping", middleware(http.HandlerFunc(pong)))
log.Fatal(http.ListenAndServe(":8080", nil))
}
You can use the same approach to create multiple middlewares and apply them on endpoints that need them.
I hope you found this post helpful.