Go: What are Go and OAuth2/JWT authentication?

1// JWT: token generation and validation
2import "github.com/golang-jwt/jwt/v5"
3
4var secretKey = []byte("your-secret-key")
5
6// Create token
7func CreateToken(userID int) (string, error) {
8    claims := jwt.MapClaims{
9        "user_id": userID,
10        "exp":     time.Now().Add(24 * time.Hour).Unix(),
11        "iat":     time.Now().Unix(),
12    }
13
14    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
15    return token.SignedString(secretKey)
16}
17
18// Validate token
19func ValidateToken(tokenString string) (jwt.MapClaims, error) {
20    token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
21        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
22            return nil, fmt.Errorf("unexpected signing method")
23        }
24        return secretKey, nil
25    })
26
27    if err != nil {
28        return nil, err
29    }
30
31    if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
32        return claims, nil
33    }
34    return nil, fmt.Errorf("invalid token")
35}
36
37// Middleware for validation
38func AuthMiddleware(next http.Handler) http.Handler {
39    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
40        tokenString := r.Header.Get("Authorization")
41        if tokenString == "" {
42            http.Error(w, "Unauthorized", 401)
43            return
44        }
45
46        tokenString = strings.TrimPrefix(tokenString, "Bearer ")
47        claims, err := ValidateToken(tokenString)
48        if err != nil {
49            http.Error(w, "Invalid token", 401)
50            return
51        }
52
53        // Add user_id to context
54        ctx := context.WithValue(r.Context(), "user_id", claims["user_id"])
55        next.ServeHTTP(w, r.WithContext(ctx))
56    })
57}