Introduction to JWTs: Authenticate and Access Protected Endpoints with Go

Introduction to JWTs: Authenticate and Access Protected Endpoints

Welcome to this lesson on JWT authentication . Building on what we learned about session-based authentication, where the server retained user sessions, we now delve into a more stateless form of authentication using JSON Web Tokens (JWTs). JWT authentication is popular because it offers a decentralized and scalable approach, which is crucial for modern applications needing to handle numerous requests efficiently. By the end of this lesson, you will understand how JWTs work and how to use them to securely authenticate API requests, enhancing your capability in managing API interactions. Let's dive into JWT authentication and explore its significance in securing endpoints.

Understanding JWT Structure

A JWT consists of three parts, separated by dots (.): text HEADER.PAYLOAD.SIGNATURE HEADER.PAYLOAD.SIGNATURE Header - Contains metadata like the token type (JWT) and signing algorithm (HS256) . Payload (Claims) - Holds user-related data, such as: sub : User ID iat : Issued time exp : Expiration time Signature - A cryptographic hash of the header and payload, signed with a secret key to prevent tampering. Example JWT (before decoding): text eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZXhwIjoxNzExNDYyODAwfQ.XYZ123... eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZXhwIjoxNzExNDYyODAwfQ.XYZ123...

How JWT Works: A Client-Side Perspective

From a client-side perspective, using JWTs involves a series of steps to ensure secure and authenticated interactions with the API. Here’s a simplified breakdown of the JWT process: User Authentication : The first step is authenticating the user through a login request. The client sends a POST request with the user’s credentials (username and password) to the API's login endpoint. Token Issuance : Upon successful authentication, the API responds with two tokens: Access Token : This token is a short-lived credential used to access protected API endpoints. It contains encoded information such as the user ID and expiration timestamp. Refresh Token : This is a longer-lived token designed to obtain a new access token without requiring the user to log in again. Token Utilization : The client stores these tokens and uses the access token to make requests to protected resources. To do this, the access token is added to the HTTP request headers under the key Authorization . It is usually included as a "Bearer" token, which simply means the token is presented as proof of authentication. So, the header looks like this: Authorization: Bearer YOUR_ACCESS_TOKEN_HERE . This tells the server that the request is authorized and should be granted access to the protected resource. Access Token Expiration : Once the access token expires, the client can use the refresh token to request a new access token, maintaining a smooth user experience without frequent logins. In this unit, we'll focus on the access token, understanding its role in securing requests to protected endpoints. Later in this course, we will delve into managing the refresh token, which plays a critical part in sustaining sessions when access tokens expire. By grasping the client-side workflow of JWTs, you can efficiently manage authenticated API interactions in a secure, scalable manner.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Signup Recap

Before diving into JWT-based authentication, let's revisit the signup process we covered in the previous lesson on session-based authentication. Here, we're registering a user with the API using a simple POST request, adding the user to the system without engaging in authentication yet. This familiar process sets the stage for our JWT authentication exploration. Here's a quick example:

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    // Base URL for the API
    baseURL := "http://localhost:8000"

    // User signup details
    signupDetails := map[string]string{
        "username": "johnsmith",
        "password": "testpass123",
    }

    // Convert signup details to JSON
    signupDetailsJSON, err := json.Marshal(signupDetails)
    if err != nil {
        fmt.Println("Error marshalling signup details:", err)
        return
    }

    // Send a POST request to the signup endpoint with user details
    resp, err := http.Post(fmt.Sprintf("%s/auth/signup", baseURL), "application/json", bytes.NewBuffer(signupDetailsJSON))
    if err != nil {
        fmt.Println("Error sending signup request:", err)
        return
    }
    defer resp.Body.Close()

    // Check if the request was successful
    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Signup failed with status: %s\n", resp.Status)
        return
    }

    // Print a success message
    fmt.Println("Signed up successfully!")
}

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    // Base URL for the API
    baseURL := "http://localhost:8000"

    // User signup details
    signupDetails := map[string]string{
        "username": "johnsmith",
        "password": "testpass123",
    }

    // Convert signup details to JSON
    signupDetailsJSON, err := json.Marshal(signupDetails)
    if err != nil {
        fmt.Println("Error marshalling signup details:", err)
        return
    }

    // Send a POST request to the signup endpoint with user details
    resp, err := http.Post(fmt.Sprintf("%s/auth/signup", baseURL), "application/json", bytes.NewBuffer(signupDetailsJSON))
    if err != nil {
        fmt.Println("Error sending signup request:", err)
        return
    }
    defer resp.Body.Close()

    // Check if the request was successful
    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Signup failed with status: %s\n", resp.Status)
        return
    }

    // Print a success message
    fmt.Println("Signed up successfully!")
}

In this code, as before, we're making a POST request to our API's signup endpoint to register a new user. This step mirrors the session-based signup approach where user data is added to the system but doesn't directly engage in authentication processes. With the user now registered, we're ready to proceed to the login step and obtain JWT tokens.

With the user now registered, the next crucial step is to log in with these credentials and begin the JWT retrieval. This process involves sending another POST request to the API:

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
)

func main() {
    // Base URL for the API
    baseURL := "http://localhost:8000"

    // User login details (same as signup details)
    loginDetails := map[string]string{
        "username": "johnsmith",
        "password": "testpass123",
    }

    // Convert login details to JSON
    loginDetailsJSON, err := json.Marshal(loginDetails)
    if err != nil {
        fmt.Println("Error marshalling login details:", err)
        return
    }

    // Send a POST request to the login endpoint with user details
    resp, err := http.Post(fmt.Sprintf("%s/auth/login", baseURL), "application/json", bytes.NewBuffer(loginDetailsJSON))
    if err != nil {
        fmt.Println("Error sending login request:", err)
        return
    }
    defer resp.Body.Close()

    // Check if the request was successful
    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Login failed with status: %s\n", resp.Status)
        return
    }

    // Read the response body
    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response body:", err)
        return
    }

    // Print a success message and the response content
    fmt.Println("Logged in successfully!")
    fmt.Println(string(body))
}

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
)

func main() {
    // Base URL for the API
    baseURL := "http://localhost:8000"

    // User login details (same as signup details)
    loginDetails := map[string]string{
        "username": "johnsmith",
        "password": "testpass123",
    }

    // Convert login details to JSON
    loginDetailsJSON, err := json.Marshal(loginDetails)
    if err != nil {
        fmt.Println("Error marshalling login details:", err)
        return
    }

    // Send a POST request to the login endpoint with user details
    resp, err := http.Post(fmt.Sprintf("%s/auth/login", baseURL), "application/json", bytes.NewBuffer(loginDetailsJSON))
    if err != nil {
        fmt.Println("Error sending login request:", err)
        return
    }
    defer resp.Body.Close()

    // Check if the request was successful
    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Login failed with status: %s\n", resp.Status)
        return
    }

    // Read the response body
    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response body:", err)
        return
    }

    // Print a success message and the response content
    fmt.Println("Logged in successfully!")
    fmt.Println(string(body))
}

In this login step, we submit a POST request that includes the user credentials. Unlike the session-based method, which used cookies to maintain sessions, this server returns JWTs that provide secure and efficient access to API resources.

Extracting Access and Refresh Tokens

Once you've successfully logged in, it's essential to extract the JWT tokens from the login response to use them in your application:

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
)

func main() {
    // Base URL for the API
    baseURL := "http://localhost:8000"

    // User login details (same as signup details)
    loginDetails := map[string]string{
        "username": "johnsmith",
        "password": "testpass123",
    }

    // Convert login details to JSON
    loginDetailsJSON, err := json.Marshal(loginDetails)
    if err != nil {
        fmt.Println("Error marshalling login details:", err)
        return
    }

    // Send a POST request to the login endpoint with user details
    resp, err := http.Post(fmt.Sprintf("%s/auth/login", baseURL), "application/json", bytes.NewBuffer(loginDetailsJSON))
    if err != nil {
        fmt.Println("Error sending login request:", err)
        return
    }
    defer resp.Body.Close()

    // Check if the request was successful
    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Login failed with status: %s\n", resp.Status)
        return
    }

    // Read the response body
    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response body:", err)
        return
    }

    // Parse the response body to extract tokens
    var responseData map[string]string
    if err := json.Unmarshal(body, &responseData); err != nil {
        fmt.Println("Error parsing response body:", err)
        return
    }

    // Extract the access token and refresh token
    accessToken := responseData["access_token"]
    refreshToken := responseData["refresh_token"]

    fmt.Println("Access Token:", accessToken)
    fmt.Println("Refresh Token:", refreshToken)
}

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
)

func main() {
    // Base URL for the API
    baseURL := "http://localhost:8000"

    // User login details (same as signup details)
    loginDetails := map[string]string{
        "username": "johnsmith",
        "password": "testpass123",
    }

    // Convert login details to JSON
    loginDetailsJSON, err := json.Marshal(loginDetails)
    if err != nil {
        fmt.Println("Error marshalling login details:", err)
        return
    }

    // Send a POST request to the login endpoint with user details
    resp, err := http.Post(fmt.Sprintf("%s/auth/login", baseURL), "application/json", bytes.NewBuffer(loginDetailsJSON))
    if err != nil {
        fmt.Println("Error sending login request:", err)
        return
    }
    defer resp.Body.Close()

    // Check if the request was successful
    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Login failed with status: %s\n", resp.Status)
        return
    }

    // Read the response body
    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response body:", err)
        return
    }

    // Parse the response body to extract tokens
    var responseData map[string]string
    if err := json.Unmarshal(body, &responseData); err != nil {
        fmt.Println("Error parsing response body:", err)
        return
    }

    // Extract the access token and refresh token
    accessToken := responseData["access_token"]
    refreshToken := responseData["refresh_token"]

    fmt.Println("Access Token:", accessToken)
    fmt.Println("Refresh Token:", refreshToken)
}

In this final code snippet, we pull out the access_token and refresh_token from the server's response. These tokens enable you to authenticate API requests and manage sessions in a stateless manner. The access token facilitates immediate request authentication, while the refresh token ensures the continuity of the session by allowing renewal of access tokens without requiring user reauthentication. By efficiently handling these tokens, we embrace a scalable and secure method for managing authenticated interactions with the API.

Making Requests to Protected Endpoints with JWT

With the access token in hand, we can now authenticate requests to protected API endpoints. This is done by including the JWT in the HTTP request headers, ensuring that the API recognizes and allows the request. Here’s how you can make a request to a secured endpoint using the access token:

package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    // Base URL for the API
    baseURL := "http://localhost:8000"

    // Access token obtained from login
    accessToken := "YOUR_ACCESS_TOKEN_HERE"

    // Define the headers with the JWT token for authentication
    client := &http.Client{}
    req, err := http.NewRequest("GET", fmt.Sprintf("%s/todos", baseURL), nil)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }
    req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))

    // Access a protected endpoint with the JWT token
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error sending request:", err)
        return
    }
    defer resp.Body.Close()

    // Check if the request was successful
    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Failed to access todos with status: %s\n", resp.Status)
        return
    }

    // Read the response body
    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response body:", err)
        return
    }

    // Print a success message and the response content
    fmt.Println("Accessed todos successfully!")
    fmt.Println(string(body))
}

package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    // Base URL for the API
    baseURL := "http://localhost:8000"

    // Access token obtained from login
    accessToken := "YOUR_ACCESS_TOKEN_HERE"

    // Define the headers with the JWT token for authentication
    client := &http.Client{}
    req, err := http.NewRequest("GET", fmt.Sprintf("%s/todos", baseURL), nil)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }
    req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", accessToken))

    // Access a protected endpoint with the JWT token
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error sending request:", err)
        return
    }
    defer resp.Body.Close()

    // Check if the request was successful
    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Failed to access todos with status: %s\n", resp.Status)
        return
    }

    // Read the response body
    body, err := io.ReadAll(resp.Body)
    if err != nil {
        fmt.Println("Error reading response body:", err)
        return
    }

    // Print a success message and the response content
    fmt.Println("Accessed todos successfully!")
    fmt.Println(string(body))
}

In this code, the access token is included in the Authorization header as a Bearer token. This header is crucial, as it signals to the API that the request is properly authenticated, granting access to the protected resources. For example, the /todos endpoint in this snippet is accessed securely, and if successful, the protected data is printed in the output.

By making requests in this manner, you ensure that sensitive operations and data retrievals are secure, leveraging the JWT approach for stateless, scalable, and flexible interaction with the API.