Use Go for JWT verification

This is a creation in Article, where the information may have evolved or changed.

For servers using load Balancing, using JWT (JSON WEB TOKEN) is a better choice, the session is limited by a single server, and once a user logs on, it can only be assigned to
On this server, this is inconsistent with the purpose of load balancing, and JWT solves this kind of pain point

Scenarios that use JWT

• Authenticated user after logon the server uses JWT to return resources that the user can access, such as permissions or whatever
• Delivery of information through JWT header and signature can be guaranteed payload not tampered with to ensure the security of information

The structure of the JWT

JWT is made up header,payload,signature of three parts, let's start with an example.

• Header

{  "alg": "HS256",  "typ": "JWT"}// base64编码的字符串`eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9`

The encryption algorithm is defined here, hash256

• Payload

{  "sub": "1234567890",  "name": "John Doe",  "admin": true}// base64编码的字符串`eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9`

这里的内容没有强制要求,因为 paylaod 就是为了承载内容而存在的,不过想用规范的话也可以参考下面的* iss: jwt签发者* sub: jwt所面向的用户* aud: 接收jwt的一方* exp: jwt的过期时间，这个过期时间必须要大于签发时间* nbf: 定义在什么时间之前，该jwt都是不可用的.* iat: jwt的签发时间* jti: jwt的唯一身份标识，主要用来作为一次性token,从而回避重放攻击。

• Signature

is encrypted with a header + payload + secret combination, the formula is:

HMACSHA256(  base64UrlEncode(header) + "." +  base64UrlEncode(payload),  secret)

Here secret is a random string of your own definition, a process that can occur only on the server side and randomly generates a hash value

This is a complete JWT after the combination:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.4c9540f793ab33b13670169bdf444c1eb1c37047f18e861981e14e34587b1e04

Here's a demo that uses go to encrypt and verify JWT

Summarize

Top reasons to choose JWT:

1. Content has a public key, which guarantees the legitimacy of the content
2. Tokens can contain a lot of information

However, JWT does not guarantee security issues:

1. Because header,paylaod it is Base64 encoded, it is equivalent to clear text, so you cannot payload put sensitive information in
2. does not guarantee that the data transmission will not be stolen, this is the same as SessionID, so do not be superstitious about how high security it.

To be safe or to get on HTTPS

Related recommendations:
Jwt.io

Blog Original