Building web applications with the Gin framework in Go is like embarking on a culinary adventure. Just like cooking a perfect dish, you need the right ingredients and a well-thought-out recipe to create a secure and efficient web application. One of the essential ingredients in this recipe is implementing custom authentication middleware. It’s crucial for securing your API endpoints and ensuring that only authorized users have access to your data.
Middleware in Gin is akin to a vigilant gatekeeper. It has access to the HTTP request and response, and its job is to perform tasks like authentication, logging, and rate limiting before the request reaches the handler function. Creating custom authentication middleware in Gin isn’t rocket science; it’s just like preparing a well-balanced meal, and this guide will walk you through it step by step.
Imagine you’re hosting a dinner party, and you want to ensure that only invited guests can enter. To achieve this, you’ll need some form of invitation verification. In our web app, JWT tokens will play the role of these invitations. So, let’s start by creating a simple authentication middleware that checks for a valid JWT token in the Authorization header of the HTTP request.
We’ll begin by defining a middleware function. This function will act like our vigilant doorman, ensuring that only guests with valid invitations (tokens) are allowed in. Here’s a simple example:
package main
import (
"github.com/gin-gonic/gin"
"net/http"
"strings"
)
func TokenAuthMiddleware() gin.HandlerFunc {
return func(c *gin.Context) {
authHeader := c.Request.Header.Get("Authorization")
if authHeader == "" || !strings.HasPrefix(authHeader, "Bearer ") {
c.JSON(http.StatusBadRequest, gin.H{"message": "Token must be provided"})
c.Abort()
return
}
token := strings.TrimPrefix(authHeader, "Bearer ")
if token != "your_valid_token" {
c.JSON(http.StatusUnauthorized, gin.H{"message": "Invalid token"})
c.Abort()
return
}
c.Next()
}
}
With our doorman (middleware) ready, it’s time to apply it to our API endpoints, making sure our party is secure. Imagine you’ve got different sections in your party – some areas are open for everyone, and some are exclusive. Here’s how you can apply the middleware to specific routes or groups of routes:
func main() {
router := gin.New()
authGroup := router.Group("/auth")
authGroup.Use(TokenAuthMiddleware())
authGroup.GET("/protected", func(c *gin.Context) {
c.JSON(http.StatusOK, gin.H{"message": "You are authenticated"})
})
router.Run(":8080")
}
Now, let’s add a touch of sophistication. Imagine knowing the name and details of each guest who enters your party. In the context of a web app, you’ll often need to extract user data from the token and make it available to your handlers. Here’s how to achieve that:
func TokenAuthMiddleware() gin.HandlerFunc {
return func(c *gin.Context) {
authHeader := c.Request.Header.Get("Authorization")
if authHeader == "" || !strings.HasPrefix(authHeader, "Bearer ") {
c.JSON(http.StatusBadRequest, gin.H{"message": "Token must be provided"})
c.Abort()
return
}
token := strings.TrimPrefix(authHeader, "Bearer ")
var user = struct {
ID string
Username string
}{
ID: "1",
Username: "john",
}
c.Set("user", user)
c.Next()
}
}
func main() {
router := gin.New()
authGroup := router.Group("/auth")
authGroup.Use(TokenAuthMiddleware())
authGroup.GET("/protected", func(c *gin.Context) {
user, _ := c.Get("user")
u := user.(struct {
ID string
Username string
})
c.JSON(http.StatusOK, gin.H{"message": "Hello, " + u.Username})
})
router.Run(":8080")
}
To ensure everything runs smoothly, it’s essential to handle errors properly. If something goes wrong during the authentication process, you should stop the execution of the request. This is like politely but firmly telling an uninvited guest that they can’t enter the party. Here’s a quick snippet to show how you can handle errors and abort the request if needed:
func TokenAuthMiddleware() gin.HandlerFunc {
return func(c *gin.Context) {
authHeader := c.Request.Header.Get("Authorization")
if authHeader == "" || !strings.HasPrefix(authHeader, "Bearer ") {
c.JSON(http.StatusBadRequest, gin.H{"message": "Token must be provided"})
c.Abort()
return
}
token := strings.TrimPrefix(authHeader, "Bearer ")
if token != "your_valid_token" {
c.JSON(http.StatusUnauthorized, gin.H{"message": "Invalid token"})
c.Abort()
return
}
c.Next()
}
}
Now, while our simple middleware works for basic scenarios, sometimes you’ll need more elaborate setups. Sometimes, you might fancy using an external library to take care of the heavy lifting. Libraries like gin-jwt can be your sous-chefs, handling intricate details of the authentication process for you.
Here’s a quick example of how gin-jwt can be used to manage your party invites:
import (
"github.com/appleboy/gin-jwt/v2"
"github.com/gin-gonic/gin"
)
var identityKey = "id"
func main() {
router := gin.New()
authMiddleware, err := jwt.New(&jwt.GinJWTMiddleware{
Realm: "test zone",
Key: []byte("secret key"),
Timeout: time.Hour * 2,
MaxRefresh: time.Hour * 10,
IdentityKey: identityKey,
PayloadFunc: func(data interface{}) jwt.MapClaims {
if v, ok := data.(string); ok && v != "" {
return jwt.MapClaims{
identityKey: v,
}
}
return jwt.MapClaims{}
},
IdentityHandler: func(c *gin.Context) interface{} {
claims := jwt.ExtractClaims(c)
return claims[identityKey]
},
Authenticator: func(c *gin.Context) (interface{}, error) {
var loginVals struct {
Username string `form:"username" json:"username" binding:"required"`
Password string `form:"password" json:"password" binding:"required"`
}
if err := c.ShouldBind(&loginVals); err != nil {
return "", jwt.ErrFailedAuthentication
}
if loginVals.Username == "admin" && loginVals.Password == "password" {
return loginVals.Username, nil
}
return nil, jwt.ErrFailedAuthentication
},
Authorizator: func(data interface{}, c *gin.Context) bool {
if v, ok := data.(string); ok && v == "admin" {
return true
}
return false
},
Unauthorized: func(c *gin.Context, code int, message string) {
c.JSON(code, gin.H{
"code": code,
"message": message,
})
},
TokenLookup: "header: Authorization",
TokenHeadName: "Bearer",
TimeFunc: time.Now,
})
if err != nil {
log.Fatal("JWT error: " + err.Error())
}
auth := router.Group("/auth")
auth.Use(authMiddleware.MiddlewareFunc())
auth.GET("/protected", func(c *gin.Context) {
claims := jwt.ExtractClaims(c)
user, _ := c.Get(identityKey)
c.JSON(200, gin.H{
"userID": claims[identityKey],
"text": "Hello " + user.(string),
})
})
router.Run(":8080")
}
For those gourmet-level authorization scenarios, where you have complex rules about who can do what, you might want to bring in the big guns, like Casbin. It’s a powerful access control library that can handle very granular permission checks. Here’s a little taste of integrating Casbin with Gin:
import (
"github.com/casbin/casbin/v2"
"github.com/gin-contrib/authz"
"github.com/gin-gonic/gin"
"net/http"
)
func main() {
e, _ := casbin.NewEnforcer("authz_model.conf", "authz_policy.csv")
router := gin.New()
router.Use(authz.NewAuthorizer(e))
router.GET("/dataset1/item1", func(c *gin.Context) {
c.JSON(http.StatusOK, gin.H{"message": "You have access to this resource"})
})
router.Run(":8080")
}
Securing your web app is as crucial as ensuring only the invited guests are at your party. Implementing custom authentication middleware with Gin makes your API endpoints secure and trustworthy. Whether you go basic with a simple token check or fancy with gin-jwt or Casbin, you can tailor your security measures to fit your specific needs.
Remember, your goal is to keep any unwanted guests out and ensure your app’s user data is safe and secure. Happy coding, and may your paths always be free of bugs and unauthorized access!