jwt-go

You can easily add authentication to Go via JWT [0]. You can also write middlewares in Go[1] ranging from auth to gzip or anything else you can think of. [0] https://github.com/dgrijalva/jwt-go [1] https://hackernoon.com/simple-http-middleware-with-go-79a4ad...

> Developers think that the data is encrypted, when it's only base64'd Doesn't it depend on the specific implementation? For example I have been using github.com/dgrijalva/jwt-go package to build a token, add claims and sign it along with github.com/auth0/go-jwt-middleware to validate the requests. The JWT in that case is signed and encoded as a string using the secret.

Oh hey, it's another "JWT libraries used to be terrible" article. Idiots shouldn't write authentication code. Especially when credentials are involved. Funny jwt-go was used as an example; it was never vulnerable to the alg-none attack: https://github.com/dgrijalva/jwt-go/commit/2b0327edf60cd8e04...

that's not a real problem. only a few frameworks having a good one. In java i handwritten mine. And golang has the same good crypto tools as Java. > https://godoc.org/golang.org/x/crypto/pbkdf2 > https://golang.org/pkg/crypto/subtle/ And finally a Token Library: https://github.com/dgrijalva/jwt-go or https://github.com/dvsekhvalnov/jose2go And that's all you need to write a Authentication / Authorization Library in 100-200 lines of code. And it will mostly be more secure than most of the things you see in the open world.

JSON web tokens are indeed pretty dope. The main vulnerability I worry about when I see it being used is in the implementation by the end user or library, in that you must validate the algorithm used to sign the key [0]; but, many libraries assume that users will read the spec before plopping in a new auth scheme into their app, and don't do this by default. Secondly, it's important to remember that JWTs can be decoded anywhere, but verified as signed by you. I've been using JWT-go [1] in my most recent app, and it's been great. [0]: https://auth0.com/blog/2015/03/31/critical-vulnerabilities-i... [1]: https://github.com/dgrijalva/jwt-go