rk-boot/v2: 使用腾讯云 KMS 进行 JWT 验证 (Golang)

$ go get github.com/rookie-ninja/rk-boot/v2
$ go get github.com/rookie-ninja/rk-gin/v2
$ go get github.com/rookie-ninja/rk-cloud/tencent/signer

---
gin:
  - name: demo
    port: 8080
    enabled: true
    middleware:
      logging:
        enabled: true                                     # 启动日志中间件
      jwt:
        enabled: true                                     # 启动 JWT 验证中间件
        ignore:
          - "/v1/login"                                   # 对于 /v1/login，忽略 JWT 验证
        signerEntry: signerT                              # 使用 tencent.signer 定义的 SignerEntry 进行验证
tencent:
  config:                                                
    - name: credT                                         # 根据需要自由取名
      override:
        accessKey: "云访问密钥 AK"                          # 云访问密钥，Access Key ID
        secretKey: "云访问密钥 SK"                          # 云访问密钥，Secret Key ID
  signer:
    - name: signerT                                        # 根据需要自由取名
      config: credT                                        # 上面的 Config 名字，让 signer 使用上面的云访问密钥
      region: ap-beijing                                   # 根据 KMS 密钥选择相应的 Region
      algorithm: RSA_PKCS1_SHA_256                         # 目前，只支持 RSA_PKCS1_SHA_256
      kmsKeyId: "KMS 密钥 ID"                               # 腾讯云 KMS 控制台里创建的 KMS 密钥 ID

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"github.com/gin-gonic/gin"
	"github.com/golang-jwt/jwt/v4"
	"github.com/rookie-ninja/rk-boot/v2"
	"github.com/rookie-ninja/rk-cloud/tencent/signer"
	"github.com/rookie-ninja/rk-entry/v2/entry"
	"github.com/rookie-ninja/rk-gin/v2/boot"
	"github.com/rookie-ninja/rk-gin/v2/middleware/context"
	"net/http"
	"time"
)

var (
	signerEntry rkentry.SignerJwt
)

func main() {
	// Create a new boot instance.
	boot := rkboot.NewBoot()

	// Register handler
	ginEntry := rkgin.GetGinEntry("demo")
	ginEntry.Router.GET("/v1/login", Login)
	ginEntry.Router.GET("/v1/greeter", Greeter)

	// Bootstrap
	boot.Bootstrap(context.Background())

	// Assign SignerEntry
	signerEntry = rktencentsigner.GetTencentSigner("signerT")

	// Wait for shutdown sig
	boot.WaitForShutdownSig(context.Background())
}

// Login API
func Login(ctx *gin.Context) {
	ctx.JSON(http.StatusOK, map[string]string{
		"accessToken": GenerateAccessToken(),
	})
}

// JWT claims contains UID
type CustomClaims struct {
	UID string `json:"uid"`
	jwt.RegisteredClaims
}

// Generate JWT access token by calling KMS
func GenerateAccessToken() string {
	now := time.Now()
	claims := CustomClaims{
		UID: "demo-id",
		RegisteredClaims: jwt.RegisteredClaims{
			ExpiresAt: jwt.NewNumericDate(now.Add(30 * time.Minute)),
			IssuedAt:  jwt.NewNumericDate(now),
			NotBefore: jwt.NewNumericDate(now),
			Issuer:    "rookie-ninja",
		},
	}

	token, _ := signerEntry.SignJwt(claims)
	return token
}

// Greeter API
func Greeter(ctx *gin.Context) {
	jwtToken := rkginctx.GetJwtToken(ctx)

	ctx.JSON(http.StatusOK, map[string]string{
		"Message": fmt.Sprintf("Hello %s!", GetUidFromJwtToken(jwtToken)),
	})
}

// Get user id from jwt token
func GetUidFromJwtToken(jwtToken *jwt.Token) string {
	claims := &CustomClaims{}

	// convert jwt map claims to json bytes
	bytes, _ := json.Marshal(jwtToken.Claims)

	// convert json bytes to custom claims
	json.Unmarshal(bytes, claims)

	return claims.UID
}

$ go run main.go

$ curl localhost:8080/v1/login
{"accessToken":"eyXXX...."}

$ curl localhost:8080/v1/greeter -H 'Authorization:Bearer eyXXX...'
{"Message":"Hello demo-id!"}

$ curl localhost:8080/v1/greeter
{"error":{"code":401,"status":"Unauthorized","message":"Invalid or expired jwt","details":[]}}