rk-boot/v2: 使用腾讯云 KMS 进行 JWT 验证 (Golang)

$ go get github.com/rookie-ninja/rk-boot/v2
$ go get github.com/rookie-ninja/rk-gin/v2
$ go get github.com/rookie-ninja/rk-cloud/tencent/signer

---
gin:
  - name: demo
    port: 8080
    enabled: true
    middleware:
      logging:
        enabled: true                                     # 启动日志中间件
      jwt:
        enabled: true                                     # 启动 JWT 验证中间件
        ignore:
          - "/v1/login"                                   # 对于 /v1/login，忽略 JWT 验证
        signerEntry: signerT                              # 使用 tencent.signer 定义的 SignerEntry 进行验证
tencent:
  config:                                                
    - name: credT                                         # 根据需要自由取名
      override:
        accessKey: "云访问密钥 AK"                          # 云访问密钥，Access Key ID
        secretKey: "云访问密钥 SK"                          # 云访问密钥，Secret Key ID
  signer:
    - name: signerT                                        # 根据需要自由取名
      config: credT                                        # 上面的 Config 名字，让 signer 使用上面的云访问密钥
      region: ap-beijing                                   # 根据 KMS 密钥选择相应的 Region
      algorithm: RSA_PKCS1_SHA_256                         # 目前，只支持 RSA_PKCS1_SHA_256
      kmsKeyId: "KMS 密钥 ID"                               # 腾讯云 KMS 控制台里创建的 KMS 密钥 ID

package main
import (

"context"

"encoding/json"

"fmt"

"github.com/gin-gonic/gin"

"github.com/golang-jwt/jwt/v4"

"github.com/rookie-ninja/rk-boot/v2"

"github.com/rookie-ninja/rk-cloud/tencent/signer"

"github.com/rookie-ninja/rk-entry/v2/entry"

"github.com/rookie-ninja/rk-gin/v2/boot"

"github.com/rookie-ninja/rk-gin/v2/middleware/context"

"net/http"

"time"

)
var (

signerEntry rkentry.SignerJwt

)
func main() {

// Create a new boot instance.

boot := rkboot.NewBoot()
// Register handler
ginEntry := rkgin.GetGinEntry("demo")
ginEntry.Router.GET("/v1/login", Login)
ginEntry.Router.GET("/v1/greeter", Greeter)

// Bootstrap
boot.Bootstrap(context.Background())

// Assign SignerEntry
signerEntry = rktencentsigner.GetTencentSigner("signerT")

// Wait for shutdown sig
boot.WaitForShutdownSig(context.Background())

}
// Login API

func Login(ctx *gin.Context) {

ctx.JSON(http.StatusOK, map[string]string{

"accessToken": GenerateAccessToken(),

})

}
// JWT claims contains UID

type CustomClaims struct {

UID string json:"uid"

jwt.RegisteredClaims

}
// Generate JWT access token by calling KMS

func GenerateAccessToken() string {

now := time.Now()

claims := CustomClaims{

UID: "demo-id",

RegisteredClaims: jwt.RegisteredClaims{

ExpiresAt: jwt.NewNumericDate(now.Add(30 * time.Minute)),

IssuedAt:  jwt.NewNumericDate(now),

NotBefore: jwt.NewNumericDate(now),

Issuer:    "rookie-ninja",

},

}
token, _ := signerEntry.SignJwt(claims)
return token

}
// Greeter API

func Greeter(ctx *gin.Context) {

jwtToken := rkginctx.GetJwtToken(ctx)
ctx.JSON(http.StatusOK, map[string]string{
	"Message": fmt.Sprintf("Hello %s!", GetUidFromJwtToken(jwtToken)),
})

}
// Get user id from jwt token

func GetUidFromJwtToken(jwtToken *jwt.Token) string {

claims := &CustomClaims{}
// convert jwt map claims to json bytes
bytes, _ := json.Marshal(jwtToken.Claims)

// convert json bytes to custom claims
json.Unmarshal(bytes, claims)

return claims.UID

}

 go run main.go</code></pre></div></div><h3 id="doh3o" name="7.-%E9%AA%8C%E8%AF%81">7. 验证</h3><p>第一步，发送 /v1/login 请求，获取 AccessToken</p><div class="rno-markdown-code"><div class="rno-markdown-code-toolbar"><div class="rno-markdown-code-toolbar-info"><div class="rno-markdown-code-toolbar-item is-type"><span class="is-m-hidden">代码语言：</span>go</div></div><div class="rno-markdown-code-toolbar-opt"><div class="rno-markdown-code-toolbar-copy"><i class="icon-copy"></i><span class="is-m-hidden">复制</span></div></div></div><div class="developer-code-block"><pre class="prism-token token line-numbers language-go"><code class="language-go" style="margin-left:0"> curl localhost:8080/v1/login

{"accessToken":"eyXXX...."}

$ curl localhost:8080/v1/greeter -H 'Authorization:Bearer eyXXX...'

{"Message":"Hello demo-id!"}

$ curl localhost:8080/v1/greeter

{"error":{"code":401,"status":"Unauthorized","message":"Invalid or expired jwt","details":[]}}