Gin框架集成JWT实现身份认证与自定义Claims

go get github.com/gin-gonic/gin
go get github.com/dgrijalva/jwt-go

import (
	"github.com/dgrijalva/jwt-go"
	"time"
)

// MyClaims 自定义声明结构体，扩展StandardClaims
type MyClaims struct {
	Username string `json:"username"` // 自定义字段：用户名
	jwt.StandardClaims                 // 内嵌标准声明
}

const TokenExpireDuration = time.Hour * 2 // Token有效期2小时
var MySecret = []byte("secret_key_for_jwt") // 替换为复杂的随机字符串

// GenToken 生成JWT
func GenToken(username string) (string, error) {
	c := MyClaims{
		Username: username,
		StandardClaims: jwt.StandardClaims{
			ExpiresAt: time.Now().Add(TokenExpireDuration).Unix(), // 计算绝对时间戳
			Issuer:    "my-project",                               // 签发来源标识
		},
	}
	token := jwt.NewWithClaims(jwt.SigningMethodHS256, c)
	return token.SignedString(MySecret)
}

// ParseToken 解析JWT
func ParseToken(tokenString string) (*MyClaims, error) {
	token, err := jwt.ParseWithClaims(tokenString, &MyClaims{}, func(token *jwt.Token) (i interface{}, err error) {
		return MySecret, nil
	})
	if err != nil {
		return nil, err
	}
	if claims, ok := token.Claims.(*MyClaims); ok && token.Valid {
		return claims, nil
	}
	return nil, errors.New("invalid token")
}

import (
	"strings"
	"net/http"
	"github.com/gin-gonic/gin"
)

// JWTAuthMiddleware 基于JWT的认证中间件
func JWTAuthMiddleware() func(c *gin.Context) {
	return func(c *gin.Context) {
		// 1. 从Header获取Authorization字段
		authHeader := c.Request.Header.Get("Authorization")
		if authHeader == "" {
			c.JSON(http.StatusOK, gin.H{
				"code": 401,
				"msg":  "请求头中auth为空",
			})
			c.Abort()
			return
		}

		// 2. 检查格式是否为 Bearer <token>
		parts := strings.SplitN(authHeader, " ", 2)
		if !(len(parts) == 2 &amp;&amp; parts[0] == "Bearer") {
			c.JSON(http.StatusOK, gin.H{
				"code": 401,
				"msg":  "请求头中auth格式有误",
			})
			c.Abort()
			return
		}

		// 3. 解析并验证Token
		mc, err := ParseToken(parts[1])
		if err != nil {
			c.JSON(http.StatusOK, gin.H{
				"code": 401,
				"msg":  "无效的Token",
			})
			c.Abort()
			return
		}

		// 4. 将解析出的用户名存入Context，供后续Handler使用
		c.Set("username", mc.Username)
		c.Next() // 继续执行后续处理函数
	}
}

type UserInfo struct {
	Username string `form:"username" json:"username" binding:"required"`
	Password string `form:"password" json:"password" binding:"required"`
}

func authHandler(c *gin.Context) {
	var user UserInfo
	if err := c.ShouldBind(&user); err != nil {
		c.JSON(http.StatusOK, gin.H{"code": 2001, "msg": "参数错误"})
		return
	}
	// 简单模拟验证：实际应从数据库校验
	if user.Username == "admin" && user.Password == "123456" {
		tokenString, _ := GenToken(user.Username)
		c.JSON(http.StatusOK, gin.H{
			"code": 2000,
			"msg":  "success",
			"data": gin.H{"token": tokenString},
		})
	} else {
		c.JSON(http.StatusOK, gin.H{"code": 2002, "msg": "鉴权失败"})
	}
}

func homeHandler(c *gin.Context) {
	// 从Context中获取之前存入的用户名
	username := c.MustGet("username").(string)
	c.JSON(http.StatusOK, gin.H{
		"code": 2000,
		"msg":  "访问成功",
		"data": gin.H{"username": username},
	})
}

func main() {
	r := gin.Default()
	
	// 登录接口（无需鉴权）
	r.POST("/login", authHandler)
	
	// 资源接口（需要鉴权）
	r.GET("/home", JWTAuthMiddleware(), homeHandler)
	
	r.Run(":8080")
}