35 lines
939 B
Go
35 lines
939 B
Go
package security
|
|
|
|
import (
|
|
"cadoles/graphql/config"
|
|
"fmt"
|
|
"log"
|
|
"net/http"
|
|
|
|
jwt "github.com/dgrijalva/jwt-go"
|
|
)
|
|
|
|
// Handle security middleware aims to implement a JWT authentication.
|
|
func Handle(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
tokenString := r.Header.Get("Authorization")[7:] // 7 corresponds to "Bearer "
|
|
|
|
token, _ := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
|
|
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
|
|
}
|
|
conf := config.GetConfig()
|
|
|
|
var secret = conf.JWT_SECRET // Prefer to store this secret in a configuration file
|
|
|
|
return []byte(secret), nil
|
|
})
|
|
|
|
if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
|
|
log.Printf("JWT Authenticated OK (app: %s)", claims["app"])
|
|
|
|
next.ServeHTTP(w, r)
|
|
}
|
|
})
|
|
}
|