Skip to content
This repository was archived by the owner on Aug 30, 2026. It is now read-only.

v0.0.1

Choose a tag to compare

View all tags
@changkun changkun released this 16 Feb 05:47
· 1 commit to main since this release
v0.0.1
d779fa0

v0.0.1 — Initial Release

A lightweight SSO login system for changkun.de services. It provides centralized JWT-based authentication with cross-subdomain cookie support, so any service under *.changkun.de can verify user identity through a single login flow.

What it does

Users visit login.changkun.de, authenticate with username and password, and receive a JWT token. The token is stored as a cookie scoped to changkun.de, making it available to all subdomains (e.g., api.changkun.de, changkun.de). Other services verify the token by calling the /verify endpoint, which returns the authenticated username.

Both a Go SDK (changkun.de/x/login) and a JavaScript SDK (/sdk.js) are provided for integration. The Go SDK is used by server-side services like the ideas API, while the JS SDK enables any webpage to check login status, trigger login/logout, and read the auth token.

How it was built

The service started as a simple Go HTTP server backed by BoltDB for credential storage, with a particle.js-themed dark UI. It was then modernized through several iterations:

  1. BoltDB replaced with environment variables — Credentials moved to LOGIN_USERNAME/LOGIN_PASSWORD env vars, eliminating the database dependency and simplifying deployment
  2. Docker setup simplified — Removed volume mounts for the DB file, switched to .env-based configuration and modern docker compose
  3. UI redesigned — Login and test pages rewritten to match the main changkun.de site style: Inter font, CSS custom properties for theming, light/dark mode with system preference detection, responsive layout
  4. Cross-subdomain SSO — Cookie attributes updated to Domain=changkun.de; Path=/; SameSite=Lax so all subdomains share the auth state
  5. SDKs added — Go package for server-side token verification and auth handling; JavaScript SDK served at /sdk.js for browser-side integration
  6. Ideas service integrated — The ideas API (api.changkun.de) was updated to validate requests via the login service's /verify endpoint, replacing its previous static token auth

Endpoints

Method Path Description
GET / Login page (accepts ?redirect= query param)
POST /auth Authenticate with {"username", "password", "redirect"}, returns JWT
POST /verify Verify JWT with {"token"}, returns {"username"}
GET /test Test page for verifying login status
GET /sdk.js JavaScript SDK for browser integration

Security

  • JWT tokens signed with HMAC-SHA256
  • IP-based rate limiting with exponential backoff after repeated failed attempts
  • Blocklist auto-clears monthly

Configuration

Environment variables (via .env):

Variable Description
LOGIN_SECRET JWT signing secret
LOGIN_PORT Server port (default :8080)
LOGIN_USERNAME Account username
LOGIN_PASSWORD Account password
Assets 2
Loading