A feature-complete, dependency-free JSON Web Token library for Go with secure API design.
pascaldekloe/jwt is a JSON Web Token (JWT) library for Go that provides a complete, secure, and dependency-free implementation for issuing and verifying tokens. It enables stateless authentication and authorization in applications, with features like key management and high-level HTTP handler integration. The library enforces secure practices by rejecting unsigned tokens and avoiding encrypted tokens, promoting the use of wire encryption instead.
Go developers building secure web applications, APIs, or microservices that require stateless authentication and authorization using JWT standards. It is particularly suited for those prioritizing security, minimal dependencies, and performance in token handling.
Developers choose this library for its strict security-by-design approach, full JWT specification compliance without external dependencies, and high-performance operations across multiple algorithms. Its unique selling point includes a built-in KeyRegister for key management and seamless HTTP handler integration for server-side validation.
JSON Web Token library
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements the full JWT specification including RFC 7519 and supports all standard algorithms like EdDSA, ECDSA, HMAC, and RSA, ensuring interoperability.
Has no external libraries, simplifying deployment and reducing attack surface, as emphasized in the README for reliability.
Features a KeyRegister for managing multiple keys and easy PEM loading, demonstrated in the high-level API example for secure key handling.
Provides efficient operations with detailed benchmarks, highlighting EdDSA's speed and small signatures for optimized authentication.
Deliberately avoids JSON Web Encryption (JWE), requiring separate wire encryption for confidentiality, which can complicate security architectures needing built-in encryption.
The high-level API is tailored for http.Handler integration, making it less suitable for non-web contexts without additional adaptation.
Lacks advanced features like token refresh mechanisms or built-in OAuth2 support, focusing solely on core JWT issuance and verification.