A JWT authentication middleware for Go HTTP servers with short-lived auth tokens, refresh tokens, and CSRF protection.
jwt-auth is a Go package that provides JSON Web Token authentication middleware for HTTP servers. It solves the problem of securing web APIs by implementing a stateless authentication system with short-lived access tokens, refresh tokens, and CSRF protection. The middleware handles token validation, issuance, and revocation while integrating seamlessly with Go's standard HTTP package and popular web frameworks.
Go developers building HTTP servers or web applications that require secure authentication for APIs, particularly those working on non-critical services that need stateless session management with CSRF protection.
Developers choose jwt-auth because it provides a complete, production-ready JWT authentication solution specifically designed for Go servers with built-in CSRF protection, flexible token transport options (cookies or headers), and easy integration with popular Go web frameworks.
This package provides json web token (jwt) middleware for goLang http servers
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements short-lived auth tokens (minutes) and longer-lived refresh tokens (hours/days) with configurable expiration times, reducing the risk of token theft as shown in the Design section.
Includes CSRF secret strings that change with each token refresh, with support for headers or form values to prevent cross-site request forgery, a key feature highlighted in the Goals.
Supports both cookies (default) and bearer tokens via the BearerTokens option, making it adaptable for web and mobile applications as explained in the 'Cookies or Bearer Tokens?' section.
Allows adding custom claims through a CustomClaims map in the ClaimsType struct, enabling storage of user roles and application-specific data in tokens, as demonstrated in the API examples.
Requires generating and managing private/public key pairs for RSA or ECDSA signing methods, adding setup complexity compared to simpler HMAC-based libraries, as seen in the Options struct.
Token revocation relies on user-implemented functions (SetCheckTokenIdFunction and SetRevokeTokenFunction), which can be error-prone and lack built-in support for distributed systems, as admitted in the API documentation.
The provided integration examples with popular Go web frameworks like Echo and Gin are labeled as 'untested' in the README, potentially leading to reliability issues in production environments.