Golang implementation of JSON Web Tokens (JWT)

Overview

jwt-go

Build Status GoDoc

A go (or 'golang' for search engine friendliness) implementation of JSON Web Tokens

NEW VERSION COMING: There have been a lot of improvements suggested since the version 3.0.0 released in 2016. I'm working now on cutting two different releases: 3.2.0 will contain any non-breaking changes or enhancements. 4.0.0 will follow shortly which will include breaking changes. See the 4.0.0 milestone to get an idea of what's coming. If you have other ideas, or would like to participate in 4.0.0, now's the time. If you depend on this library and don't want to be interrupted, I recommend you use your dependency mangement tool to pin to version 3.

SECURITY NOTICE: Some older versions of Go have a security issue in the cryotp/elliptic. Recommendation is to upgrade to at least 1.8.3. See issue #216 for more detail.

SECURITY NOTICE: It's important that you validate the alg presented is what you expect. This library attempts to make it easy to do the right thing by requiring key types match the expected alg, but you should take the extra step to verify it in your usage. See the examples provided.

What the heck is a JWT?

JWT.io has a great introduction to JSON Web Tokens.

In short, it's a signed JSON object that does something useful (for example, authentication). It's commonly used for Bearer tokens in Oauth 2. A token is made of three parts, separated by .'s. The first two parts are JSON objects, that have been base64url encoded. The last part is the signature, encoded the same way.

The first part is called the header. It contains the necessary information for verifying the last part, the signature. For example, which encryption method was used for signing and what key was used.

The part in the middle is the interesting bit. It's called the Claims and contains the actual stuff you care about. Refer to the RFC for information about reserved keys and the proper way to add your own.

What's in the box?

This library supports the parsing and verification as well as the generation and signing of JWTs. Current supported signing algorithms are HMAC SHA, RSA, RSA-PSS, and ECDSA, though hooks are present for adding your own.

Examples

See the project documentation for examples of usage:

Extensions

This library publishes all the necessary components for adding your own signing methods. Simply implement the SigningMethod interface and register a factory method using RegisterSigningMethod.

Here's an example of an extension that integrates with multiple Google Cloud Platform signing tools (AppEngine, IAM API, Cloud KMS): https://github.com/someone1/gcp-jwt-go

Compliance

This library was last reviewed to comply with RTF 7519 dated May 2015 with a few notable differences:

  • In order to protect against accidental use of Unsecured JWTs, tokens using alg=none will only be accepted if the constant jwt.UnsafeAllowNoneSignatureType is provided as the key.

Project Status & Versioning

This library is considered production ready. Feedback and feature requests are appreciated. The API should be considered stable. There should be very few backwards-incompatible changes outside of major version updates (and only with good reason).

This project uses Semantic Versioning 2.0.0. Accepted pull requests will land on master. Periodically, versions will be tagged from master. You can find all the releases on the project releases page.

While we try to make it obvious when we make breaking changes, there isn't a great mechanism for pushing announcements out to users. You may want to use this alternative package include: gopkg.in/dgrijalva/jwt-go.v3. It will do the right thing WRT semantic versioning.

BREAKING CHANGES:*

  • Version 3.0.0 includes a lot of changes from the 2.x line, including a few that break the API. We've tried to break as few things as possible, so there should just be a few type signature changes. A full list of breaking changes is available in VERSION_HISTORY.md. See MIGRATION_GUIDE.md for more information on updating your code.

Usage Tips

Signing vs Encryption

A token is simply a JSON object that is signed by its author. this tells you exactly two things about the data:

  • The author of the token was in the possession of the signing secret
  • The data has not been modified since it was signed

It's important to know that JWT does not provide encryption, which means anyone who has access to the token can read its contents. If you need to protect (encrypt) the data, there is a companion spec, JWE, that provides this functionality. JWE is currently outside the scope of this library.

Choosing a Signing Method

There are several signing methods available, and you should probably take the time to learn about the various options before choosing one. The principal design decision is most likely going to be symmetric vs asymmetric.

Symmetric signing methods, such as HSA, use only a single secret. This is probably the simplest signing method to use since any []byte can be used as a valid secret. They are also slightly computationally faster to use, though this rarely is enough to matter. Symmetric signing methods work the best when both producers and consumers of tokens are trusted, or even the same system. Since the same secret is used to both sign and validate tokens, you can't easily distribute the key for validation.

Asymmetric signing methods, such as RSA, use different keys for signing and verifying tokens. This makes it possible to produce tokens with a private key, and allow any consumer to access the public key for verification.

Signing Methods and Key Types

Each signing method expects a different object type for its signing keys. See the package documentation for details. Here are the most common ones:

  • The HMAC signing method (HS256,HS384,HS512) expect []byte values for signing and validation
  • The RSA signing method (RS256,RS384,RS512) expect *rsa.PrivateKey for signing and *rsa.PublicKey for validation
  • The ECDSA signing method (ES256,ES384,ES512) expect *ecdsa.PrivateKey for signing and *ecdsa.PublicKey for validation

JWT and OAuth

It's worth mentioning that OAuth and JWT are not the same thing. A JWT token is simply a signed JSON object. It can be used anywhere such a thing is useful. There is some confusion, though, as JWT is the most common type of bearer token used in OAuth2 authentication.

Without going too far down the rabbit hole, here's a description of the interaction of these technologies:

  • OAuth is a protocol for allowing an identity provider to be separate from the service a user is logging in to. For example, whenever you use Facebook to log into a different service (Yelp, Spotify, etc), you are using OAuth.
  • OAuth defines several options for passing around authentication data. One popular method is called a "bearer token". A bearer token is simply a string that should only be held by an authenticated user. Thus, simply presenting this token proves your identity. You can probably derive from here why a JWT might make a good bearer token.
  • Because bearer tokens are used for authentication, it's important they're kept secret. This is why transactions that use bearer tokens typically happen over SSL.

Troubleshooting

This library uses descriptive error messages whenever possible. If you are not getting the expected result, have a look at the errors. The most common place people get stuck is providing the correct type of key to the parser. See the above section on signing methods and key types.

More

Documentation can be found on godoc.org.

The command line utility included in this project (cmd/jwt) provides a straightforward example of token creation and parsing as well as a useful tool for debugging your own integration. You'll also find several implementation examples in the documentation.

Comments
  • key is invalid or of invalid type

    key is invalid or of invalid type

    I got the following error:

    key is invalid or of invalid type
    

    by the following code. I'm not sure if I'm missing anything.

    package main
    
    import (
        "fmt"
        "github.com/dgrijalva/jwt-go"
        "time"
    )
    
    func main() {
        tokenString, err := CreateJwtToken()
        if err != nil {
            fmt.Println(err)
        }
        fmt.Println(tokenString)
    }
    
    func CreateJwtToken() (string, error) {
        token := jwt.New(jwt.SigningMethodHS256)
        token.Claims["foo"] = "bar"
        token.Claims["exp"] = time.Now().Add(time.Hour * 72).Unix()
        tokenString, err := token.SignedString("netdata.io")
        return tokenString, err
    }
    
    opened by elgs 39
  • Custom parsing

    Custom parsing

    Another implementation where Claims can be an actual struct.

    Used a lot of the same ideas as #66, however rather than making the interface have each check, I went with a interface of Valid() error

    This is still a breaking API change for where users access values from the Claims object currently, as they would need to cast to either jwt.MapClaim, or their object.

    Example Implementation

    The "Can" method on ScopeInfo is really why I want this. Without it, you have to reconstruct the object from a map[string]interface{}

    type Claims struct {
        Audience  string `json:"aud,omitempty"`
        Client    string `json:"cid,omitempty"`
        Expiry    int64  `json:"exp,omitempty"`
        Id        string `json:"jti,omitempty"`
        IssuedAt  int64  `json:"iat,omitempty"`
        Issuer    string `json:"iss,omitempty"`
        NotBefore int64  `json:"nbf,omitempty"`
        Scope     Scope  `json:"scope"`
        Subject   string `json:"sub,omitempty"`
    }
    
    func (c Claims) Valid() error {
        now := time.Now().Unix()
    
        if now > c.Expiry {
            return errors.New("token is expired")
        }
    
        if now < c.NotBefore {
            return errors.New("token is not valid yet")
        }
    
        return nil
    }
    
    type ScopeInfo struct {
        Actions []string `json:"actions"`
    }
    
    type Scope struct {
        User ScopeInfo `json:"user"`
    }
    
    func (u *ScopeInfo) Can(scopes ...string) bool {
        privledged := true
        for _, scope := range scopes {
            matched := false
            for _, cmp := range u.Actions {
                if scope == cmp {
                    matched = true
                    break
                }
            }
    
            if matched == false {
                privledged = false
                break
            }
        }
        return privledged
    }
    
    // Creating a token with specific claims
    claims := Claims{}
    claims.Audience = "https://myapi.com"
    claims.Client = "client-id"
    claims.Expiry = time.Now().Add(1 * time.Hour).Unix()
    claims.IssuedAt = time.Now().Unix()
    claims.Issuer = "https://sso.myapi.com"
    claims.Scope = Scope{
        User: ScopeInfo{
            Actions: []string{"read"},
        },
    }
    token := jwt.NewWithClaims(jwt.GetSigningMethod("RS256"), claims)
    
    
    //Parsing a token
    token, err := jwt.ParseWithClaims(activationToken, func(token *jwt.Token) (interface{}, error) {
        if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok {
            return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
        }
        return apiVerifyKey, nil
    }, &Claims{})
    
    if err != nil || token.Valid == false {
        //err handle
    }
    
    claims := token.Claims.(*Claims)
    if !claims.Scope.User.Can("read") {
        //I can use my structs!
    }
    

    #64

    opened by itsjamie 28
  • Vulnerabilities in JSON Web Token

    Vulnerabilities in JSON Web Token

    Hi,

    I believe some of the vulnerabilities mentioned in this article are also applicable to this library:

    Critical vulnerabilities in JSON Web Token libraries

    Think it would be good to add an argument to the Parse function which tells it which algorithm to use.

    opened by wunki 28
  • added support for ed25519

    added support for ed25519

    opened by vtolstov 22
  • 3.0

    3.0

    Opening a ticket for discussion. There are several proposed changes that will not be backwards compatible. It makes sense to land them together so we don't have to break integration multiple times. These are the changes I'm thinking of for 3.x:

    • Dropping support for passing []byte to the RSA signing methods. Instead, use the helper methods to deserialize your keys first. See #59
    • Support for custom types for Claims. See #66 and #73
    • Potentially adding support for json.Number, though I haven't fully grokked that yet. I need to re-read the json library documentation. #68
    • Potentially moving ParseFromRequest to a sub package and adding some options. This is a very popular request.

    Things that look like they can land in 2.x:

    • Support for ECDSA signing methods (#74)
    • Support for RSASSA-PSS signing methods (#72)

    I'm still on the fence about supporting none out of the box, though, if we did it would look something like https://github.com/dgrijalva/jwt-go/pull/34#issuecomment-58966750

    Thoughts? Ideas? Did I miss something?

    opened by dgrijalva 20
  • Unable to decode my own custom map[string]interface{} type

    Unable to decode my own custom map[string]interface{} type

    I was trying to upgrade my https://github.com/goware/jwtauth HTTP middleware for jwt auth which uses this package, and came across an issue when I use my own map[string]interface{} type to decode a jwt token.

    ie.

    package mypkg
    
    type Claims map[string]interface{}
    // Claims to have its own methods, including Valid() error method
    
    func decodeExample(tokenString string) (*jwt.Token, error) {
       t, err := jwt.ParseWithClaims(tokenString, Claims{}, keyFunc)
       return t, err
    }
    

    I consistently get an error for the same reason as the comment regarding the json decode special case. In my example, the code will hit: https://github.com/dgrijalva/jwt-go/blob/master/parser.go#L58

    one solution, is to just use jwt.Parse() without a custom claims, then wrap the type from as, claims := Claims(t.Claims.(MapClaims)) .. which works, however, it will still enforce the Valid() method from MapClaims which I don't want.. so it's a bit more restrictive then what was previously suppoed in 2.x

    let me know if you have any suggestions, but I believe the ParseWithClaims() methods needs to be reworked a bit to avoid that special case

    opened by pkieltyka 19
  • pass keys as interface{} rather than []byte

    pass keys as interface{} rather than []byte

    This will allow clients to pass, for example, their own instances of rsa.PublicKey if the key is not specified as some flavour of X509 cert. For example, Salesforce just specify the modulus and exponent (https://login.salesforce.com/id/keys)

    opened by simonjefford 16
  • Is this project still maintained?

    Is this project still maintained?

    Hi,

    Thank you so much for this project. It's very helpful. I'm just wondering if there is still time to maintain this code. I noticed that https://github.com/auth0/go-jwt-middleware uses a fork due to "jwt-go not being actively maintained" and noticed a few tickets in https://github.com/dgrijalva/jwt-go/issues that mention security issues. An update on project status, or maybe finding someone willing to take over (maybe from the fork auth-0 uses?) would be useful.

    Thanks!

    opened by cep21 14
  • Release 3.0.0

    Release 3.0.0

    See #75

    • [x] Drop support for []byte when using RSA signing methods
    • [x] Support for custom Claim types
    • [x] Migrate ParseFromRequest to a subpackage.
    • [x] Modify request parsing API to provide more flexibility.
    • [x] Updated release notes and documentation
    • [x] Decide on landing #139 (leeway and validation options)
    opened by dgrijalva 14
  • non api breaking fix to MapClaims VerifyAudience

    non api breaking fix to MapClaims VerifyAudience

    This is non api breaking fix to MapClaims VerifyAudience problem. This could be release as patch version v3.2.1

    See these comments; https://github.com/dgrijalva/jwt-go/issues/463#issuecomment-854975451 https://github.com/dgrijalva/jwt-go/issues/463#issuecomment-854979458

    this does not change StandardClaims.Audience type as it not a actual problem for StandardClaims.VerifyAudience. Go type system will not allow slice to assigned to string. Problematic part is MapClaims.VerifyAudience which is handling intefaces

    opened by aldas 13
  • StandardClaims Audience must be an array of strings according to https://tools.ietf.org/html/rfc7519#section-4.1

    StandardClaims Audience must be an array of strings according to https://tools.ietf.org/html/rfc7519#section-4.1

    According to https://tools.ietf.org/html/rfc7519#section-4.1 the aud claim in StandardClaims should be an array of strings and currently in jwt-go is defined as string.

    opened by pakalvoltan 13
  • Security Issue - Authorization bypass

    Security Issue - Authorization bypass

    While merging branches, Github throws me the security alert message shown below.

    Severity is 7.5/10.

    "jwt-go allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to golang-jwt at version 3.2.1" Screenshot 2022-05-21 at 00 09 11 Screenshot 2022-05-21 at 00 09 22

    opened by davitdarsalia 0
  • key is invalid error with RS256 generated from https://mkjwk.org/

    key is invalid error with RS256 generated from https://mkjwk.org/

    I am using the library like this:

    package main
    
    import (
    	"fmt"
    	"time"
    
    	"github.com/dgrijalva/jwt-go"
    )
    
    var jwtKey = []byte(`
    {
        "p": "7KKWYO2Mdmjm1eIAjpMOtcjfYlslYVthVVecxJyq4sr9v9HUxmN-VWCJaDBBb9iTm8zCoRNauiNhgk4vViK56T6Ooo93GHiHsVtpIB9MgL1NZuHoHZtQL6iq1faRp2A5Xca8TrcxQ4k8snHpndjjnrQj1XtvEESzL23lu-S-280",
        "kty": "RSA",
        "q": "rr-eu9klZeYH8D3DZ6OmBlVFCi7dFHx9uepcrHOlxeZJBg9y5882X2Uw_z4OfIBUHNux0yKXkkHhehiM7gSxb7m75ap54LWG35q9JGU2qI_DvlvEgMObqz-YER4satI7LPbIMISHUyqkcN86SA9olVLNK3kDEsukx_LcnKs7bxc",
        "d": "QxO-9QTZtZ7oHIifMBlFInIstI8CYdVobLhbl_OFA8vTygX_ZG5-i-REYaYUJyx_WwHYYI8HsWmbZsrf2rc7Y76E2OCRGuyEK4lA-YeP2FYX09hwuIvYTXc_KErenp6rbo8W0EU49FIYdTk7Szlx9RF-gatOZXVJqM-nHnh3sHm3facnBba94_2L91eIKezJ1VeuWwxpR2sRZzbQdrOI_sPYurIdLZGeTGYF7kKIcgyMydxchRpiKKapXm--sPewNlzw7NMMU5PLXKIc9YA8rKU2G1OgRxVOrleeKiK4zLZY46ry60Lu2zzwLTQL6uyiGIG0f9hp0TYZY8qedShS-Q",
        "e": "AQAB",
        "use": "sig",
        "kid": "sdfasda",
        "qi": "dsVrwVQnK9WigTluBTq5DTHkbRoeKhp67y8i4LaE5hst3vSd_VrFB1aYhJuHD-c0B8cBt-QQbqN7sUit7OiXS8u7iIoIuTTsS0vBexpJpPMv-GGOQnBrc0pyFvLX_HjJqZRBH4ZsBmI4Zfn6E0NCjEuSPfksxYYz4Df62T9jrgM",
        "dp": "tE7bCPZYziz2n0i7JehWEBwEYrySyhFIJDBDCulZqMAGA_COEbDkJYgOi24hnmjHaLLoJrZJroWhGhobJaYGRPze0G1C0UmeE31UqB5RO9OCs_80z8J1oisCKVDdAU1nyNXSzKP4DL74mfwEh7spDdezakrIgPvoER7LK5WL_I0",
        "alg": "RS256",
        "dq": "K79vJsoDEdKX1C4yOEUA8H7ybM00rcdI1n10u_ur2bKAP5Moih4XF6TGsm-_wq2B4UOi7h-v4H67ywxQY9oq7bSK9MFMB9SKMnqTtYPdPi_XqlVhCXdvBl1CXa63IfsFs4kIrxTOqCR5zIQmHBo3bYKwOJzwBwmSdDg5wMMhevs",
        "n": "oYeiPhASwtqH9RhjfaEPxaw3j-iWIwwDvrnIaPgUT9A175fJ10mKWJ4butQPXQJKcGHcOJ88pftcXe_KBW2sGj5VYyFiPzVpU3C5TFITbtseTEo0VCNDisow2no4BVFDj2h95EA9WGwbktyqE0C4Dc2-_iBXJlQuOY_RBlOlEOxRzxEBxMOiolN9X2CfqJ6DpFKR3wr58pbaYGgdzTL6dRA_aJ7P-V7x8_IYFGYqwYjThIXvWOGwWaSR6Q4iA8pwuNOPegJeFxPom0u67vMZ65EU_c0WH4kv8ucqQq7g_GgL2IDmWaRYykiy6OE8G-hHAGIW898IoyHpkW3K5bKiaw"
    }
    `)
    
    type Claims struct {
    	Username string `json:"username"`
    	jwt.StandardClaims
    }
    
    func main() {
    	expirationTime := time.Now().Add(5 * time.Minute)
    
    	claims := &Claims{
    		Username: "prakhar",
    		StandardClaims: jwt.StandardClaims{
    			// In JWT, the expiry time is expressed as unix milliseconds
    			ExpiresAt: expirationTime.Unix(),
    		},
    	}
    
    	// Declare the token with the algorithm used for signing, and the claims
    	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
    	// Create the JWT string
    	tokenString, err := token.SignedString(jwtKey)
    	if err != nil {
    		fmt.Println(err)
    		return
    	}
    
    	fmt.Println(tokenString)
    
    	tkn, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
    		return jwtKey, nil
    	})
    	if err != nil {
    		if err == jwt.ErrSignatureInvalid {
    			fmt.Println(err)
    			return
    		}
    		fmt.Println(err)
    	}
    	if !tkn.Valid {
    		fmt.Println(err)
    		return
    	}
    
    	// Finally, return the welcome message to the user, along with their
    	// username given in the token
    	fmt.Printf("Welcome %s!", claims.Username)
    }
    
    

    And its not able to use the key. It fails saying key is invalid. Could you please look into this?

    opened by prakharmishra 0
  • cannot use time.Now().Add(time.Hour * 24).Unix() (type int64) as type *jwt.Time in field value

    cannot use time.Now().Add(time.Hour * 24).Unix() (type int64) as type *jwt.Time in field value

    Why am i getting this error?

    cannot use time.Now().Add(time.Hour * 24).Unix() (type int64) as type *jwt.Time in field value
    

    Here is what i have

    import (
    	"github.com/gofiber/fiber/v2"
    	"golang.org/x/crypto/bcrypt"
    	"github.com/dgrijalva/jwt-go/v4"
    	"strconv"
    	"time"
    )
    
    	payload := jwt.StandardClaims{
    		Subject: strconv.Itoa(int(user.Id)),
    		ExpiresAt: time.Now().Add(time.Hour * 24).Unix(),
    	}
    
    	token, err := jwt.NewWithClaims(jwt.SigningMethodHS256, payload).SignedString([]byte("secret"))
    

    What am i doing wrong here???

    issue is on this particular line

    		ExpiresAt: time.Now().Add(time.Hour * 24).Unix(),
    
    opened by encryptblockr 3
  • CVE-2021-33890

    CVE-2021-33890

    This is my last attempt at contacting the maintainers before I make a public disclosure of this vulnerability whose severity I gauge at medium. If you are a maintainer of this repository, please send me an email to echo '[email protected]' | tr 'b-za' 'a-yz'.

    opened by grantzvolsky 7
  • add deprecated message to go.mod

    add deprecated message to go.mod

    README says "THIS REPOSITORY IS NO LONGER MAINTANED", however many modules still import this repository.

    • https://pkg.go.dev/github.com/dgrijalva/jwt-go?tab=importedby

    Module deprecation comments are available from Go 1.17: https://golang.org/doc/go1.17 The comment notify the deprecated message to the users.

    opened by shogo82148 1
Releases(v0.15.2)
Owner
Dave Grijalva
Dave Grijalva
A go implementation of JSON Web Tokens

jwt-go A go (or 'golang' for search engine friendliness) implementation of JSON Web Tokens NEW VERSION COMING: There have been a lot of improvements s

null 3.4k Oct 2, 2022
Go-gin-jwt - Secure web api using jwt token and caching mechanism

Project Description This project demonstrate how to create api and secure it wit

Jeremy Panjaitan 0 Jan 27, 2022
Golang jwt tokens without any external dependency

Yet another jwt lib This is a simple lib made for small footprint and easy usage It allows creating, signing, reading and verifying jwt tokens easily

Karpelès Lab Inc. 1 Oct 11, 2021
:key: Secure alternative to JWT. Authenticated Encrypted API Tokens for Go.

branca branca is a secure alternative to JWT, This implementation is written in pure Go (no cgo dependencies) and implements the branca token specific

Wesley Hill 167 Sep 20, 2022
Generate and verify JWT tokens with Trusted Platform Module (TPM)

golang-jwt for Trusted Platform Module (TPM) This is just an extension for go-jwt i wrote over thanksgiving that allows creating and verifying JWT tok

null 3 Jul 29, 2022
Generate and verify JWT tokens with PKCS-11

golang-jwt for PKCS11 Another extension for go-jwt that allows creating and verifying JWT tokens where the private key is embedded inside Hardware lik

null 2 Aug 25, 2022
Safe, simple and fast JSON Web Tokens for Go

jwt JSON Web Token for Go RFC 7519, also see jwt.io for more. The latest version is v3. Rationale There are many JWT libraries, but many of them are h

cristaltech 567 Oct 1, 2022
A simple and lightweight library for creating, formatting, manipulating, signing, and validating JSON Web Tokens in Go.

GoJWT - JSON Web Tokens in Go GoJWT is a simple and lightweight library for creating, formatting, manipulating, signing and validating Json Web Tokens

Toby 5 Feb 7, 2022
Microservice generates pair of access and refresh JSON web tokens signed by user identifier.

go-jwt-issuer Microservice generates pair access and refresh JSON web tokens signed by user identifier. ?? Deployed on Heroku Run tests: export SECRET

Oleksii Velychko 28 Sep 10, 2022
JWT wrapper library which makes it simple to use ECDSA based JWT signing

JWT JWT wrapper library which makes it simple to user ECDSA based JWT signing. Usage package main import ( "context" "github.com/infiniteloopcloud

infinite loop 0 Feb 10, 2022
Account-jwt-go - Simple JWT api with go, gorm, gin

Account JWT on Go Go, gorm, Gin web framework 를 활용하여 만든 간단한 JWT API 입니다. Dajngo의

Deagwon Bu 1 Apr 14, 2022
Krakend-jwt-header-rewriter - Kraken Plugin - JWT Header Rewriter

Kraken Plugin - JWT Header Rewriter 1 Plugin Configuration Name Desciption Defau

null 0 Feb 15, 2022
This package provides json web token (jwt) middleware for goLang http servers

jwt-auth jwt auth middleware in goLang. If you're interested in using sessions, checkout my sessions library! README Contents: Quickstart Performance

Adam Hanna 220 Sep 18, 2022
Platform-Agnostic Security Tokens implementation in GO (Golang)

Golang implementation of PASETO: Platform-Agnostic Security Tokens This is a 100% compatible pure Go (Golang) implementation of PASETO tokens. PASETO

Oleg Lobanov 633 Oct 5, 2022
A simple authentication web application in Golang (using jwt)

Simple Authentication WebApp A simple authentication web app in Go (using JWT) Routes Path Method Data /api/v1/auth/register POST {"firstname":,"lastn

Shayan 2 Feb 6, 2022
This is an implementation of JWT in golang!

jwt This is a minimal implementation of JWT designed with simplicity in mind. What is JWT? Jwt is a signed JSON object used for claims based authentic

John Rowley 97 Sep 15, 2022
Golang implementation of JWT and Refresh Token

Fiber and JWT with Refresh Token Repo ini adalah demostrasi JWT support refresh token tanpa menggunakan storage Branch Main: unlimited refresh token R

Muhamad Surya Iksanudin 19 Sep 29, 2022
An implementation of JOSE standards (JWE, JWS, JWT) in Go

Go JOSE Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. This includes support for JSO

Square 2k Sep 30, 2022
A fast and simple JWT implementation for Go

JWT Fast and simple JWT implementation written in Go. This package was designed with security, performance and simplicity in mind, it protects your to

Gerasimos (Makis) Maropoulos 148 Oct 2, 2022