Authorization and Authentication in Go (Golang)

Authorization and Authentication in Go (Golang): Overview of Key Tools

Authentication (verifying user identity) and authorization (checking access rights) are fundamental components of any web application. In the Go (Golang) ecosystem, there are several proven libraries that allow you to implement these mechanisms quickly, securely, and with minimal code. In this article, we will look at four main approaches: password hashing, JWT tokens, session management, and OAuth2.

1. Password Hashing: `golang.org/x/crypto/bcrypt`

The first step of any authentication is secure password storage. Never store passwords in plain text! The bcrypt package from the Go standard collection provides a proven hashing algorithm with an adaptive cost factor.

Installation:

go get golang.org/x/crypto/bcrypt

Registration and Login Example:

package main

import (    "fmt"    "golang.org/x/crypto/bcrypt")

func hashPassword(password string) (string, error) {    bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)    return string(bytes), err}

func checkPasswordHash(password, hash string) bool {    err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))    return err == nil}

func main() {    password := "mySecretP@ssw0rd"    hash, _ := hashPassword(password)

    fmt.Println("Hash:", hash)

    // Checking the correct password    match := checkPasswordHash(password, hash)    fmt.Println("Password match:", match) // true

    // Checking an incorrect password    match = checkPasswordHash("wrong", hash)    fmt.Println("Wrong password match:", match) // false}

Important: bcrypt.DefaultCost is 10. For a higher level of security (but slower), use a value of 12-14. Never use a cost less than 10.

2. JWT (JSON Web Tokens) — `github.com/golang-jwt/jwt/v5`

JWT is a compact way to transmit data between parties as a JSON object. It is ideal for REST APIs and microservices. The golang-jwt/jwt package is the most popular and actively maintained.

Installation:

go get github.com/golang-jwt/jwt/v5

Example of Creating and Verifying a JWT:

package main

import (    "fmt"    "time"    "github.com/golang-jwt/jwt/v5")

var jwtSecret = []byte("your-secret-key-keep-it-safe")

func createToken(userID string) (string, error) {    claims := jwt.MapClaims{        "user_id": userID,        "exp":     time.Now().Add(24 * time.Hour).Unix(),    }    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)    return token.SignedString(jwtSecret)}

func verifyToken(tokenString string) (string, error) {    token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {            return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])        }        return jwtSecret, nil    })    if err != nil {        return "", err    }    if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {        return claims["user_id"].(string), nil    }    return "", fmt.Errorf("invalid token")}

func main() {    token, _ := createToken("user123")    fmt.Println("JWT:", token)

    userID, err := verifyToken(token)    if err != nil {        fmt.Println("Error:", err)    } else {        fmt.Println("Authenticated user:", userID)    }}

Tip: Store the secret key in environment variables, not in the code. For production, use asymmetric encryption (RS256).