Authorization and Authentication in Go (Golang): A Complete Guide

Authorization and Authentication in Go (Golang)

In modern web development with Go (Golang), the security of user data and access control are critically important aspects. Libraries and tools for authorization and authentication allow developers to quickly and reliably implement protection in their applications. In this article, we will explore the main approaches and popular libraries for implementing authentication (verifying user identity) and authorization (determining access rights) in Go.

Core Concepts

Before moving to the tools, it is important to distinguish between two key concepts:

• Authentication — the process of verifying that a user is who they claim to be (typically via login/password, tokens, OAuth).
• Authorization — the process of determining which resources and actions are available to an authenticated user (roles, access rights).

Popular Libraries and Tools

1. bcrypt for Password Hashing

The golang.org/x/crypto/bcrypt library is the de facto standard for secure password storage. It automatically adds a salt and uses an adaptive hashing function.

package main

import (    "fmt"    "golang.org/x/crypto/bcrypt")

func main() {    password := "mySecretPassword123"        // Hashing the password    hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)    if err != nil {        panic(err)    }    fmt.Printf("Hash: %s", hash)        // Verifying the password    err = bcrypt.CompareHashAndPassword(hash, []byte("wrongPassword"))    if err != nil {        fmt.Println("Password is incorrect:", err)    } else {        fmt.Println("Password is correct")    }        // Successful verification    err = bcrypt.CompareHashAndPassword(hash, []byte(password))    if err == nil {        fmt.Println("Password is correct!")    }}

2. JWT (JSON Web Tokens) with the golang-jwt Library

The github.com/golang-jwt/jwt/v5 library allows you to create and verify JWT tokens. This is a popular way to implement stateless authentication.

package main

import (    "fmt"    "time"    "github.com/golang-jwt/jwt/v5")

var jwtSecret = []byte("super-secret-key")

func createToken(userID string) (string, error) {    claims := jwt.MapClaims{        "user_id": userID,        "exp":     time.Now().Add(time.Hour * 24).Unix(),        "iat":     time.Now().Unix(),    }        token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)    return token.SignedString(jwtSecret)}

func validateToken(tokenString string) (string, error) {    token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {            return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])        }        return jwtSecret, nil    })        if err != nil {        return "", err    }        if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {        return claims["user_id"].(string), nil    }        return "", fmt.Errorf("invalid token")}

func main() {    // Creating a token    token, _ := createToken("user123")    fmt.Println("JWT Token:", token)        // Validating the token    userID, err := validateToken(token)    if err != nil {        fmt.Println("Validation error:", err)    } else {        fmt.Println("User ID from token:", userID)    }}

3. Session-based Authentication with gorilla/sessions

For traditional session-based authentication, use github.com/gorilla/sessions. Sessions are stored on the server, and only a cookie with the session ID is sent to the client.

package main

import (    "net/http"    "github.com/gorilla/sessions")\