jwt

README

package auth/jwt

package auth/jwt provides a set of interfaces for service authorization through JSON Web Tokens.

Usage

NewParser takes a key function and an expected signing method and returns an endpoint.Middleware. The middleware will parse a token passed into the context via the jwt.JWTContextKey. If the token is valid, any claims will be added to the context via the jwt.JWTClaimsContextKey.

import (
	stdjwt "github.com/golang-jwt/jwt/v4"

	"github.com/openmesh/kit/auth/jwt"
	"github.com/openmesh/kit/endpoint"
)

func main() {
	var exampleEndpoint endpoint.Endpoint
	{
		kf := func(token *stdjwt.Token) (interface{}, error) { return []byte("SigningString"), nil }
		exampleEndpoint = MakeExampleEndpoint(service)
		exampleEndpoint = jwt.NewParser(kf, stdjwt.SigningMethodHS256, jwt.StandardClaimsFactory)(exampleEndpoint)
	}
}

NewSigner takes a JWT key ID header, the signing key, signing method, and a claims object. It returns an endpoint.Middleware. The middleware will build the token string and add it to the context via the jwt.JWTContextKey.

import (
	stdjwt "github.com/golang-jwt/jwt/v4"

	"github.com/openmesh/kit/auth/jwt"
	"github.com/openmesh/kit/endpoint"
)

func main() {
	var exampleEndpoint endpoint.Endpoint
	{
		exampleEndpoint = grpctransport.NewClient(...).Endpoint()
		exampleEndpoint = jwt.NewSigner(
			"kid-header",
			[]byte("SigningString"),
			stdjwt.SigningMethodHS256,
			jwt.Claims{},
		)(exampleEndpoint)
	}
}

In order for the parser and the signer to work, the authorization headers need to be passed between the request and the context. HTTPToContext(), ContextToHTTP(), GRPCToContext(), and ContextToGRPC() are given as helpers to do this. These functions implement the correlating transport's RequestFunc interface and can be passed as ClientBefore or ServerBefore options.

Example of use in a client:

import (
	stdjwt "github.com/golang-jwt/jwt/v4"

	grpctransport "github.com/openmesh/kit/transport/grpc"
	"github.com/openmesh/kit/auth/jwt"
	"github.com/openmesh/kit/endpoint"
)

func main() {

	options := []httptransport.ClientOption{}
	var exampleEndpoint endpoint.Endpoint
	{
		exampleEndpoint = grpctransport.NewClient(..., grpctransport.ClientBefore(jwt.ContextToGRPC())).Endpoint()
		exampleEndpoint = jwt.NewSigner(
			"kid-header",
			[]byte("SigningString"),
			stdjwt.SigningMethodHS256,
			jwt.Claims{},
		)(exampleEndpoint)
	}
}

Example of use in a server:

import (
	"context"

	"github.com/openmesh/kit/auth/jwt"
	"github.com/go-kit/log"
	grpctransport "github.com/openmesh/kit/transport/grpc"
)

func MakeGRPCServer(ctx context.Context, endpoints Endpoints, logger log.Logger) pb.ExampleServer {
	options := []grpctransport.ServerOption{grpctransport.ServerErrorLogger(logger)}

	return &grpcServer{
		createUser: grpctransport.NewServer(
			ctx,
			endpoints.CreateUserEndpoint,
			DecodeGRPCCreateUserRequest,
			EncodeGRPCCreateUserResponse,
			append(options, grpctransport.ServerBefore(jwt.GRPCToContext()))...,
		),
		getUser: grpctransport.NewServer(
			ctx,
			endpoints.GetUserEndpoint,
			DecodeGRPCGetUserRequest,
			EncodeGRPCGetUserResponse,
			options...,
		),
	}
}

Documentation

Index

• Constants
• Variables
• func ContextToGRPC() grpc.ClientRequestFunc
• func ContextToHTTP() http.RequestFunc
• func GRPCToContext() grpc.ServerRequestFunc
• func HTTPToContext() http.RequestFunc
• func MapClaimsFactory() jwt.Claims
• func NewParser[Request, Response any](keyFunc jwt.Keyfunc, method jwt.SigningMethod, newClaims ClaimsFactory) endpoint.Middleware[Request, Response]
• func NewSigner[Request, Response any](kid string, key []byte, method jwt.SigningMethod, claims jwt.Claims) endpoint.Middleware[Request, Response]
• func StandardClaimsFactory() jwt.Claims
• type ClaimsFactory

Constants

const (
	// JWTContextKey holds the key used to store a JWT in the context.
	JWTContextKey contextKey = "JWTToken"

	// JWTTokenContextKey is an alias for JWTContextKey.
	//
	// Deprecated: prefer JWTContextKey.
	JWTTokenContextKey = JWTContextKey

	// JWTClaimsContextKey holds the key used to store the JWT Claims in the
	// context.
	JWTClaimsContextKey contextKey = "JWTClaims"
)

Variables

var (
	// ErrTokenContextMissing denotes a token was not passed into the parsing
	// middleware's context.
	ErrTokenContextMissing = errors.New("token up for parsing was not passed through the context")

	// ErrTokenInvalid denotes a token was not able to be validated.
	ErrTokenInvalid = errors.New("JWT was invalid")

	// ErrTokenExpired denotes a token's expire header (exp) has since passed.
	ErrTokenExpired = errors.New("JWT is expired")

	// ErrTokenMalformed denotes a token was not formatted as a JWT.
	ErrTokenMalformed = errors.New("JWT is malformed")

	// ErrTokenNotActive denotes a token's not before header (nbf) is in the
	// future.
	ErrTokenNotActive = errors.New("token is not valid yet")

	// ErrUnexpectedSigningMethod denotes a token was signed with an unexpected
	// signing method.
	ErrUnexpectedSigningMethod = errors.New("unexpected signing method")
)

Functions

func ContextToGRPC

func ContextToGRPC() grpc.ClientRequestFunc

ContextToGRPC moves a JWT from context to grpc metadata. Particularly useful for clients.

func ContextToHTTP

func ContextToHTTP() http.RequestFunc

ContextToHTTP moves a JWT from context to request header. Particularly useful for clients.

func GRPCToContext

func GRPCToContext() grpc.ServerRequestFunc

GRPCToContext moves a JWT from grpc metadata to context. Particularly userful for servers.

func HTTPToContext

func HTTPToContext() http.RequestFunc

HTTPToContext moves a JWT from request header to context. Particularly useful for servers.

func MapClaimsFactory

func MapClaimsFactory() jwt.Claims

MapClaimsFactory is a ClaimsFactory that returns an empty jwt.MapClaims.

func NewParser

func NewParser[Request, Response any](keyFunc jwt.Keyfunc, method jwt.SigningMethod, newClaims ClaimsFactory) endpoint.Middleware[Request, Response]

NewParser creates a new JWT parsing middleware, specifying a jwt.Keyfunc interface, the signing method and the claims type to be used. NewParser adds the resulting claims to endpoint context or returns error on invalid token. Particularly useful for servers.

func NewSigner

func NewSigner[Request, Response any](kid string, key []byte, method jwt.SigningMethod, claims jwt.Claims) endpoint.Middleware[Request, Response]

NewSigner creates a new JWT generating middleware, specifying key ID, signing string, signing method and the claims you would like it to contain. Tokens are signed with a Key ID header (kid) which is useful for determining the key to use for parsing. Particularly useful for clients.

func StandardClaimsFactory

func StandardClaimsFactory() jwt.Claims

StandardClaimsFactory is a ClaimsFactory that returns an empty jwt.StandardClaims.

Types

type ClaimsFactory

type ClaimsFactory func() jwt.Claims

ClaimsFactory is a factory for jwt.Claims. Useful in NewParser middleware.