go开源库之jwt-go使用
开源库地址:
jwt-go
该包支持多种加密方式,我们这里使用HS256进行演示
- 项目中下载工具包
go get -u github.com/dgrijalva/jwt-go
- 生成token
mySigningKey := []byte("AllYourBase")
// Create the Claims
claims := &jwt.StandardClaims{
ExpiresAt: 15000, // reqiured
Issuer: "test",
}
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
sToken, err := token.SignedString(mySigningKey)
fmt.Printf("%v %v", sToken, err)
- 解析token
tokenString := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmb28iOiJiYXIiLCJleHAiOjE1MDAwLCJpc3MiOiJ0ZXN0In0.HE7fK0xOQwFEr4WDgRWj4teRPZ6i3GLwD5YCm6Pwu_c"
type MyCustomClaims struct {
Foo string `json:"foo"`
jwt.StandardClaims
}
// sample token is expired. override time so it parses as valid
tokenClaims, err := jwt.ParseWithClaims(token, &MyCustomClaims{},func(token *jwt.Token) (interface{}, error) {
return []byte("AllYourBase"), nil
})
if tokenClaims != nil {
if claims, ok := tokenClaims.Claims.(*MyCustomClaims); ok && tokenClaims.Valid {
fmt.Printf("%v %v", claims.Foo, claims.StandardClaims.ExpiresAt)
} else {
fmt.Println(err)
}
}
个人实战
package jwt
...
...
var jwtSecret = []byte("AllYourBase")
type Claims struct {
Username string `json:"username"`
// 感谢 @剑尘 同学的提醒,这里修改为用户唯一码
UserCode string `json:"user_code"`
jwt.StandardClaims
}
func GenerateToken(username, user_code string) (string, error) {
expireAt := time.Now().Add(time.Hour).Unix()
claims := Claims{
username,
user_code,
jwt.StandardClaims{
ExpiresAt: expireAt,
Issuer: "xxxxxx",
},
}
tokenClaims := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
token, err := tokenClaims.SignedString(jwtSecret)
return token, err
}
func ParseToken(token string) (*Claims, error) {
tokenClaims, err := jwt.ParseWithClaims(token, &Claims{}, func(token *jwt.Token) (interface{}, error) {
return jwtSecret, nil
})
if tokenClaims != nil {
if claims, ok := tokenClaims.Claims.(*Claims); ok && tokenClaims.Valid {
return claims, nil
}
}
return nil, err
}
生成token
token, err := jwt.GenerateToken(username, user_code)
解析token
claims, err := jwt.ParseToken(token)
本作品采用《CC 协议》,转载必须注明作者和本文链接
最好不要带 password 这个token分成三部分。payload部分 base64解密 用户名密码 就暴漏了