-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.go
155 lines (138 loc) · 4.46 KB
/
main.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
//
// Sample output:
//
// [peter@pak ~]$ curl -v http://localhost:3333/
// * Trying ::1...
// * Connected to localhost (::1) port 3333 (#0)
// > GET / HTTP/1.1
// > Host: localhost:3333
// > User-Agent: curl/7.49.1
// > Accept: */*
// >
// < HTTP/1.1 200 OK
// < Date: Tue, 13 Sep 2016 15:53:17 GMT
// < Content-Length: 17
// < Content-Type: text/plain; charset=utf-8
// <
// * Connection #0 to host localhost left intact
// welcome anonymous%
//
//
// [peter@pak ~]$ curl -v http://localhost:3333/admin
// * Trying ::1...
// * Connected to localhost (::1) port 3333 (#0)
// > GET /admin HTTP/1.1
// > Host: localhost:3333
// > User-Agent: curl/7.49.1
// > Accept: */*
// >
// < HTTP/1.1 401 Unauthorized
// < Content-Type: text/plain; charset=utf-8
// < X-Content-Type-Options: nosniff
// < Date: Tue, 13 Sep 2016 15:53:19 GMT
// < Content-Length: 13
// <
// Unauthorized
// * Connection #0 to host localhost left intact
//
//
// [peter@pak ~]$ curl -H"Authorization: BEARER eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjN9.PZLMJBT9OIVG2qgp9hQr685oVYFgRgWpcSPmNcw6y7M" -v http://localhost:3333/admin
// * Trying ::1...
// * Connected to localhost (::1) port 3333 (#0)
// > GET /admin HTTP/1.1
// > Host: localhost:3333
// > User-Agent: curl/7.49.1
// > Accept: */*
// > Authorization: BEARER eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxMjN9.PZLMJBT9OIVG2qgp9hQr685oVYFgRgWpcSPmNcw6y7M
// >
// < HTTP/1.1 200 OK
// < Date: Tue, 13 Sep 2016 15:54:26 GMT
// < Content-Length: 22
// < Content-Type: text/plain; charset=utf-8
// <
// * Connection #0 to host localhost left intact
// protected area. hi 123%
//
package main
import (
"fmt"
"net/http"
"os"
"time"
"github.com/dgrijalva/jwt-go"
jwtauth "github.com/distributed-go/go-toolkit/authentication"
"github.com/go-chi/chi"
)
var tokenAuth jwtauth.JWTAuth
var tokenSecret = []byte("secretpass")
func init() {
tokenAuth = jwtauth.NewJWTAuth(jwtauth.Config{
JwtAuthAlgo: "HS256",
JwtParser: &jwt.Parser{},
SignKey: tokenSecret,
VerifyKey: nil,
JwtExpiry: time.Minute * 10,
JwtRefreshExpiry: time.Minute * 60,
})
// For debugging/example purposes, we generate and print
// a sample jwt token with claims `user_id:123` here:
accessToken, refreshToken, err := tokenAuth.GenTokenPair(&jwtauth.AppClaims{
UserID: "123",
Name: "Mike JSON",
Roles: []jwtauth.Role{jwtauth.Role("USER"), jwtauth.Role("ADMIN_READ_ONLY")},
}, &jwtauth.RefreshClaims{
UserID: "123",
Roles: []jwtauth.Role{jwtauth.Role("USER"), jwtauth.Role("ADMIN_READ_ONLY")},
})
if err != nil {
fmt.Println("ERROR: ", err)
os.Exit(1)
}
fmt.Printf("AccessToken: %s \nRefreshToken: %s \n", accessToken, refreshToken)
}
func main() {
addr := ":3333"
fmt.Printf("Starting server on %v\n", addr)
http.ListenAndServe(addr, router())
}
func router() http.Handler {
r := chi.NewRouter()
// Protected routes
r.Group(func(r chi.Router) {
// Seek, verify and validate JWT tokens
r.Use(tokenAuth.Verify())
// Handle valid / invalid tokens. In this example, we use
// the provided authenticator middleware, but you can write your
// own very easily, look at the Authenticator method in jwtauth.go
// and tweak it, its not scary.
r.Use(tokenAuth.Authenticate)
r.Get("/admin", func(w http.ResponseWriter, r *http.Request) {
_, claims, _ := tokenAuth.TokenFromContext(r.Context())
w.Write([]byte(fmt.Sprintf("protected area. hi %v", claims["uid"])))
})
})
// Protected routes with USER ROLES
r.Group(func(r chi.Router) {
// Seek, verify and validate JWT tokens
r.Use(tokenAuth.Verify())
// Handle valid / invalid tokens. In this example, we use
// the provided authenticator middleware, but you can write your
// own very easily, look at the Authenticator method in jwtauth.go
// and tweak it, its not scary.
r.Use(tokenAuth.Authenticate)
// This middleware checks if the token has the appropriate ROLE to access
// the resources. It will return 403 if given role is not present in the JWT Token
r.Use(tokenAuth.RequiresRole(jwtauth.Role("ADMIN_READ_ONLY"))) // try changing role to something else
r.Get("/adminReadOnly", func(w http.ResponseWriter, r *http.Request) {
_, claims, _ := tokenAuth.TokenFromContext(r.Context())
w.Write([]byte(fmt.Sprintf("protected area - read only admin. hi %v", claims["uid"])))
})
})
// Public routes
r.Group(func(r chi.Router) {
r.Get("/", func(w http.ResponseWriter, r *http.Request) {
w.Write([]byte("welcome anonymous"))
})
})
return r
}