^-^
【go工程组件】轻量级认证机制jwt
最近更新：2024-12-11   |   字数总计：2k   |   阅读估时：11分钟   |   阅读量：次
  1. 轻量级认证机制jwt
    1. jwt认证机制原理
    2. HS、RSA、ES、ED签名算法
      1. 密钥生成器接口
      2. HS
      3. RSA
      4. ES
      5. ED
      6. 验证结果
    3. HS、RS、ES、ED签名与验签
      1. HS
      2. RS
      3. ES
      4. ED
      5. 验证结果

轻量级认证机制jwt

  • JWT：JSON Web Token
  • JWT字符串的三部分：
    alt text
    1. Header：签名算法
    2. Payload：携带的用户内容
      • Header与Payload部分没有被加密，而是做了Base64URL编码（敏感信息不要用jwt）
    3. Signature：Payload基于Header的签名算法后生成的签名内容

jwt认证机制原理

alt text

  • 加密和签名的区别：
    1. 加密是可逆的（可以解密），签名是不可逆的
    2. 非对称加密，是公钥加密，私钥解密；非对称签名，是私钥加密，公钥验签（通常是服务器签名后发给客户端，客户端通信的时候将签名内容再带回来）；

HS、RSA、ES、ED签名算法

密钥生成器接口

  • secret.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    package screte

    const KEY_PATH = "keys"

    type OutSecrete struct {
    	Secrete        string
    	PublicKeyFile  string
    	PrivateKeyFile string
    }

    type Secrete interface {
    	Generate() (*OutSecrete, error)
    }

HS

  • hs.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    package screte

    import (
    	"encoding/hex"
    	"math/rand"
    	"time"
    )

    type HsGenerator struct {
    	Length int
    }

    // hs随机生成一个固定位数的字符串作为密钥(对称加密)
    func (hs *HsGenerator) Generate() (*OutSecrete, error) {
    	out := &OutSecrete{}
    	length := 32
    	if hs.Length > 0 {
    		length = hs.Length
    	}
    	rand.Seed(time.Now().UnixNano())
    	b := make([]byte, length)
    	rand.Read(b)
    	out.Secrete = hex.EncodeToString(b)[:length]
    	return out, nil
    }

RSA

  • rs.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    package screte

    import (
    	"crypto/rand"
    	"crypto/rsa"
    	"crypto/x509"
    	"encoding/pem"
    	"log"
    	"os"
    )

    type RsGenerator struct {
    }

    func (rs *RsGenerator) Generate() (*OutSecrete, error) {
    	out := &OutSecrete{}
    	var err error
    	// 生成密钥对，这个包生成的密钥是包含公私钥的
    	keys, err := rsa.GenerateKey(rand.Reader, 1024)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	// 以x509格式封装私钥
    	x509PrivateKey, err := x509.MarshalPKCS8PrivateKey(keys)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	// 以x509格式封装公钥
    	x509PublicKey, err := x509.MarshalPKIXPublicKey(&keys.PublicKey)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	// 将公私钥写入文件中
    	privateBlock := &pem.Block{
    		Type:  "PRIVATE KEY",
    		Bytes: x509PrivateKey,
    	}
    	publicBlock := &pem.Block{
    		Type:  "PUBLIC KEY",
    		Bytes: x509PublicKey,
    	}
    	privateKeyFile := KEY_PATH + "/RS/private_key.pem"
    	file, err := os.OpenFile(privateKeyFile, os.O_CREATE|os.O_WRONLY, 0644)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	defer file.Close()
    	pem.Encode(file, privateBlock)
    	publicKeyFile := KEY_PATH + "/RS/public_key.pem"
    	file, err = os.OpenFile(publicKeyFile, os.O_CREATE|os.O_WRONLY, 0644)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	defer file.Close()
    	pem.Encode(file, publicBlock)
    	out.PrivateKeyFile = privateKeyFile
    	out.PublicKeyFile = publicKeyFile
    	return out, err
    }

ES

  • es.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    package screte

    import (
    	"crypto/ecdsa"
    	"crypto/elliptic"
    	"crypto/rand"
    	"crypto/x509"
    	"encoding/pem"
    	"log"
    	"os"
    )

    type ESSigningMethod string

    const (
    	ES256 ESSigningMethod = "ES256"
    	ES384 ESSigningMethod = "ES384"
    	ES512 ESSigningMethod = "ES512"
    )

    type EsGenerator struct {
    	SigningMethod ESSigningMethod // 有三种
    }

    func (es *EsGenerator) getCurve() elliptic.Curve {
    	switch es.SigningMethod {
    	case ES256:
    		return elliptic.P256()
    	case ES384:
    		return elliptic.P384()
    	case ES512:
    		return elliptic.P521()
    	}
    	return elliptic.P256()
    }

    func (es *EsGenerator) Generate() (*OutSecrete, error) {
    	out := &OutSecrete{}
    	var err error
    	keys, err := ecdsa.GenerateKey(es.getCurve(), rand.Reader) // 和rs算法仅这里不同
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	// 以x509格式封装私钥
    	x509PrivateKey, err := x509.MarshalPKCS8PrivateKey(keys)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	// 以x509格式封装公钥
    	x509PublicKey, err := x509.MarshalPKIXPublicKey(&keys.PublicKey)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	// 将公私钥写入文件中
    	privateBlock := &pem.Block{
    		Type:  "PRIVATE KEY",
    		Bytes: x509PrivateKey,
    	}
    	publicBlock := &pem.Block{
    		Type:  "PUBLIC KEY",
    		Bytes: x509PublicKey,
    	}
    	privateKeyFile := KEY_PATH + "/ES/private_key.pem"
    	file, err := os.OpenFile(privateKeyFile, os.O_CREATE|os.O_WRONLY, 0644)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	defer file.Close()
    	pem.Encode(file, privateBlock)
    	publicKeyFile := KEY_PATH + "/ES/public_key.pem"
    	file, err = os.OpenFile(publicKeyFile, os.O_CREATE|os.O_WRONLY, 0644)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	defer file.Close()
    	pem.Encode(file, publicBlock)
    	out.PrivateKeyFile = privateKeyFile
    	out.PublicKeyFile = publicKeyFile
    	return out, err
    }

ED

  • ed.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    package screte

    import (
    	"crypto/ed25519"
    	"crypto/rand"
    	"crypto/x509"
    	"encoding/pem"
    	"log"
    	"os"
    )

    type EdGenerator struct {
    }

    func (ed *EdGenerator) Generate() (*OutSecrete, error) {
    	out := &OutSecrete{}
    	var err error
    	pubkey, prikey, err := ed25519.GenerateKey(rand.Reader)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	// 以x509格式封装私钥
    	x509PrivateKey, err := x509.MarshalPKCS8PrivateKey(prikey)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	// 以x509格式封装公钥
    	x509PublicKey, err := x509.MarshalPKIXPublicKey(pubkey)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	// 将公私钥写入文件中
    	privateBlock := &pem.Block{
    		Type:  "PRIVATE KEY",
    		Bytes: x509PrivateKey,
    	}
    	publicBlock := &pem.Block{
    		Type:  "PUBLIC KEY",
    		Bytes: x509PublicKey,
    	}
    	privateKeyFile := KEY_PATH + "/ED/private_key.pem"
    	file, err := os.OpenFile(privateKeyFile, os.O_CREATE|os.O_WRONLY, 0644)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	defer file.Close()
    	pem.Encode(file, privateBlock)
    	publicKeyFile := KEY_PATH + "/ED/public_key.pem"
    	file, err = os.OpenFile(publicKeyFile, os.O_CREATE|os.O_WRONLY, 0644)
    	if err != nil {
    		log.Println(err)
    		return nil, err
    	}
    	defer file.Close()
    	pem.Encode(file, publicBlock)
    	out.PrivateKeyFile = privateKeyFile
    	out.PublicKeyFile = publicKeyFile
    	return out, err
    }

验证结果

  • main.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    package main

    import (
    	"fmt"
    	"jwt/screte"
    )

    func main() {
    	hs := screte.HsGenerator{
    		Length: 16,
    	}
    	res, err := hs.Generate()
    	fmt.Println(res, err)

    	rs := screte.RsGenerator{}
    	res, err = rs.Generate()
    	fmt.Println(res, err)

    	es := screte.EsGenerator{
    		SigningMethod: screte.ES512,
    	}
    	res, err = es.Generate()
    	fmt.Println(res, err)

    	ed := screte.EdGenerator{}
    	res, err = ed.Generate()
    	fmt.Println(res, err)
    }

    alt text

HS、RS、ES、ED签名与验签

  • 安装jwt依赖
    1
    go get -u github.com/golang-jwt/jwt/v4
  • 定义数据接口，jwt.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    package jwts

    import "github.com/golang-jwt/jwt/v4"

    type Data struct { // 不要携带敏感信息
    	Name   string
    	Age    int
    	Gender int
    	// ExpiresAt time.Time // 自定义验证方法使用
    	jwt.RegisteredClaims
    }

    // 自定义验证方法，假如内嵌了jwt.RegisteredClaims可以不用写
    // func (d *Data) Valid() error {
    // 	if d.ExpiresAt.After(time.Now()) {
    // 		return nil
    // 	} else {
    // 		return errors.New("token已经过期")
    // 	}
    // }

    // 签名和验签的接口
    type Jwt interface {
    	Sign(data jwt.Claims) (string, error)
    	Verify(sign string, data jwt.Claims) error
    }

HS

  • hs.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    package jwts

    import (
    	"log"

    	"github.com/golang-jwt/jwt/v4"
    )

    type HSSignedMethod string

    const (
    	HS256 HSSignedMethod = "HS256"
    	HS384 HSSignedMethod = "HS384"
    	HS512 HSSignedMethod = "HS512"
    )

    type HSJwt struct {
    	Key        string
    	SignMethod HSSignedMethod
    }

    // 签名
    func (hs *HSJwt) Sign(data jwt.Claims) (string, error) {
    	token := jwt.NewWithClaims(hs.getSignMethod(), data)
    	sign, err := token.SignedString([]byte(hs.Key))
    	if err != nil {
    		log.Println(err)
    		return "", err
    	}
    	return sign, err
    }

    // 验签，并获取数据
    func (hs *HSJwt) Verify(sign string, data jwt.Claims) error {
    	_, err := jwt.ParseWithClaims(sign, data, func(t *jwt.Token) (interface{}, error) {
    		return []byte(hs.Key), nil
    	})
    	return err
    }

    func (hs *HSJwt) getSignMethod() *jwt.SigningMethodHMAC {
    	switch hs.SignMethod {
    	case HS256:
    		return jwt.SigningMethodHS256
    	case HS384:
    		return jwt.SigningMethodHS384
    	case HS512:
    		return jwt.SigningMethodHS512
    	}
    	return jwt.SigningMethodHS256
    }

RS

  • rs.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    package jwts

    import (
    	"log"

    	"github.com/golang-jwt/jwt/v4"
    )

    type RSJwt struct {
    	SignMethod RSSignMethod
    	PrivateKey string
    	PublicKey  string
    }

    type RSSignMethod string

    const (
    	RS256 RSSignMethod = "RS256"
    	RS384 RSSignMethod = "RS384"
    	RS512 RSSignMethod = "RS512"
    )

    func (rs *RSJwt) getSignMethod() *jwt.SigningMethodRSA {
    	switch rs.SignMethod {
    	case RS256:
    		return jwt.SigningMethodRS256
    	case RS384:
    		return jwt.SigningMethodRS384
    	case RS512:
    		return jwt.SigningMethodRS512
    	}
    	return jwt.SigningMethodRS256
    }

    // 签名
    func (rs *RSJwt) Sign(data jwt.Claims) (string, error) {
    	token := jwt.NewWithClaims(rs.getSignMethod(), data)
    	prikey, err := jwt.ParseRSAPrivateKeyFromPEM([]byte(rs.PrivateKey))
    	if err != nil {
    		log.Println(err)
    		return "", err
    	}
    	sign, err := token.SignedString(prikey)
    	if err != nil {
    		log.Println(err)
    		return "", err
    	}
    	return sign, err
    }

    // 验签，并获取数据
    func (rs *RSJwt) Verify(sign string, data jwt.Claims) error {
    	_, err := jwt.ParseWithClaims(sign, data, func(t *jwt.Token) (interface{}, error) {
    		pubkey, err := jwt.ParseRSAPublicKeyFromPEM([]byte(rs.PublicKey))
    		return pubkey, err
    	})
    	return err
    }

ES

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
package jwts

import (
	"log"

	"github.com/golang-jwt/jwt/v4"
)

type ESJwt struct {
	SignMethod ESSignMethod
	PrivateKey string
	PublicKey  string
}

type ESSignMethod string

const (
	ES256 ESSignMethod = "ES256"
	ES384 ESSignMethod = "ES384"
	ES512 ESSignMethod = "ES512"
)

func (rs *ESJwt) getSignMethod() *jwt.SigningMethodECDSA {
	switch rs.SignMethod {
	case ES256:
		return jwt.SigningMethodES256
	case ES384:
		return jwt.SigningMethodES384
	case ES512:
		return jwt.SigningMethodES512
	}
	return jwt.SigningMethodES256
}

// 签名
func (es *ESJwt) Sign(data jwt.Claims) (string, error) {
	token := jwt.NewWithClaims(es.getSignMethod(), data)
	prikey, err := jwt.ParseECPrivateKeyFromPEM([]byte(es.PrivateKey))
	if err != nil {
		log.Println(err)
		return "", err
	}
	sign, err := token.SignedString(prikey)
	if err != nil {
		log.Println(err)
		return "", err
	}
	return sign, err
}

// 验签，并获取数据
func (es *ESJwt) Verify(sign string, data jwt.Claims) error {
	_, err := jwt.ParseWithClaims(sign, data, func(t *jwt.Token) (interface{}, error) {
		pubkey, err := jwt.ParseECPublicKeyFromPEM([]byte(es.PublicKey))
		return pubkey, err
	})
	return err
}

ED

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
package jwts

import (
	"log"

	"github.com/golang-jwt/jwt/v4"
)

type EDJwt struct {
	PrivateKey string
	PublicKey  string
}

// 签名
func (ed *EDJwt) Sign(data jwt.Claims) (string, error) {
	token := jwt.NewWithClaims(jwt.SigningMethodEdDSA, data)
	prikey, err := jwt.ParseEdPrivateKeyFromPEM([]byte(ed.PrivateKey))
	if err != nil {
		log.Println(err)
		return "", err
	}
	sign, err := token.SignedString(prikey)
	if err != nil {
		log.Println(err)
		return "", err
	}
	return sign, err
}

// 验签，并获取数据
func (ed *EDJwt) Verify(sign string, data jwt.Claims) error {
	_, err := jwt.ParseWithClaims(sign, data, func(t *jwt.Token) (interface{}, error) {
		pubkey, err := jwt.ParseEdPublicKeyFromPEM([]byte(ed.PublicKey))
		return pubkey, err
	})
	return err
}

验证结果

  • main.go
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    package main

    import (
    	"fmt"
    	"jwt/jwts"
    	"jwt/screte"
    	"os"
    	"time"

    	"github.com/golang-jwt/jwt/v4"
    )

    func main() {
    	// GenerateSkeys()
    	data := &jwts.Data{
    		Name:   "lin",
    		Age:    8,
    		Gender: 1,
    		RegisteredClaims: jwt.RegisteredClaims{
    			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
    			IssuedAt:  jwt.NewNumericDate(time.Now()),
    			NotBefore: jwt.NewNumericDate(time.Now()),
    		},
    	}
    	var err error
    	var sign string
    	outData := &jwts.Data{}

    	/*hs签名与验签*/
    	hs := jwts.HSJwt{
    		Key:        "123456",
    		SignMethod: jwts.HS512,
    	}
    	sign, err = hs.Sign(data)
    	fmt.Println(sign, err)
    	err = hs.Verify(sign, outData)
    	fmt.Println(outData, err)
    	/*rs签名与验签*/
    	privateKey, _ := os.ReadFile("keys/RS/private_key.pem")
    	publicKey, _ := os.ReadFile("keys/RS/public_key.pem")
    	rs := jwts.RSJwt{
    		SignMethod: jwts.RS384, // 可以与生成密钥的配置不一致
    		PrivateKey: string(privateKey),
    		PublicKey:  string(publicKey),
    	}
    	sign, err = rs.Sign(data)
    	fmt.Println(sign, err)
    	err = rs.Verify(sign, outData)
    	fmt.Println(outData, err)
    	/*es签名与验签*/
    	privateKey, _ = os.ReadFile("keys/ES/private_key.pem")
    	publicKey, _ = os.ReadFile("keys/ES/public_key.pem")
    	es := jwts.ESJwt{
    		SignMethod: jwts.ES512, // 必须与生成密钥的配置一致
    		PrivateKey: string(privateKey),
    		PublicKey:  string(publicKey),
    	}
    	sign, err = es.Sign(data)
    	fmt.Println(sign, err)
    	err = es.Verify(sign, outData)
    	fmt.Println(outData, err)
    	/*ed签名与验签*/
    	privateKey, _ = os.ReadFile("keys/ED/private_key.pem")
    	publicKey, _ = os.ReadFile("keys/ED/public_key.pem")
    	ed := jwts.EDJwt{
    		PrivateKey: string(privateKey),
    		PublicKey:  string(publicKey),
    	}
    	sign, err = ed.Sign(data)
    	fmt.Println(sign, err)
    	err = ed.Verify(sign, outData)
    	fmt.Println(outData, err)
    }

    // 生成密钥
    func GenerateSkeys() {
    	hs := screte.HsGenerator{
    		Length: 16,
    	}
    	res, err := hs.Generate()
    	fmt.Println(res, err)

    	rs := screte.RsGenerator{}
    	res, err = rs.Generate()
    	fmt.Println(res, err)

    	es := screte.EsGenerator{
    		SigningMethod: screte.ES512,
    	}
    	res, err = es.Generate()
    	fmt.Println(res, err)

    	ed := screte.EdGenerator{}
    	res, err = ed.Generate()
    	fmt.Println(res, err)
    }

    alt text
2024-12-10 该篇文章被 Cleofwine 归为分类: Go云原生

上一篇：【go工程组件】字段验证器validator 下一篇：【go工程组件】对象关系映射gorm
© 2023-2026 Cleofwine / Email / GitHub / 浙ICP备2024136127号
🌙赠我弯弯一枚月，也赠予我晚星⭐ 本站由Hexo驱动｜使用Hexo-theme-A4主题