Session-Based Authentication with Go: Managing User Sessions and Accessing Protected Resources

Introduction to Session-Based Authentication

Welcome to this lesson on session-based authentication using Go. In the previous lesson, we explored API authentication using API keys, focusing on how these keys act as a passcode for gaining access to protected endpoints. Here, we take a step further and explore session-based authentication, a method where the server maintains user session information, providing a stateful experience. Unlike API keys, which are stateless, session-based authentication provides a user-friendly way to manage active sessions, track user interactions, and facilitate access to resources. By the end of this lesson, you will be capable of signing up, logging in, accessing protected resources, and logging out using session-based authentication in Go.

Understanding Session-Based Authentication

Session-based authentication in Go involves maintaining user session information on the server, creating a stateful experience. Whether you are using a web browser or a Go client to interact with a RESTful API, session-based authentication involves the server managing session data, often using cookies to track the session. When you log in to a RESTful API using your Go client, the server starts a "session" for you. This session is like a temporary ID card that validates your identity during your interactions with the API. A critical part of this process involves a "cookie," which is a small piece of data sent from the server and stored by your client. In the context of a Go-based client: Session Creation : After logging in by sending a POST request with your username and password, the server creates a unique session ID, often returned in a cookie. Ongoing Requests : Your Go client, using http.CookieJar, can store and include the session cookie in subsequent requests to the API. This allows the server to recognize the session without needing to re-enter your credentials. Session Termination : When your client logs out by sending a logout request, the server invalidates the session, stopping further requests with the old session ID from succeeding, safeguarding your session integrity. By using http.CookieJar, you can manage cookies and session data seamlessly, enabling effective interaction with RESTful API endpoints while maintaining user state securely.

Managing Sessions with Go

Before diving into the authentication steps, it is crucial to understand how to manage sessions using Go. The net/http package in Go provides the http.CookieJar interface, which allows for automatic handling of cookies between requests. Here’s how you can establish a session using Go: Gopackage main import ( "net/http" "net/http/cookiejar" "fmt" ) func main() { jar, _ := cookiejar.New(nil) // Create a cookie jar to store session cookies client := &http.Client{Jar: jar} // HTTP client with automatic cookie handling fmt.Println("Session handling initialized with CookieJar") }

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
    "net/http/cookiejar"
)

func main() {
    baseURL := "http://localhost:8000"
    jar, _ := cookiejar.New(nil)
    client := &http.Client{Jar: jar}

    authDetails := map[string]string{
        "username": "johnsmith",
        "password": "testpass123",
    }

    jsonData, _ := json.Marshal(authDetails)
    resp, err := client.Post(fmt.Sprintf("%s/auth/signup", baseURL), "application/json", bytes.NewBuffer(jsonData))
    if err != nil {
        fmt.Println("Error making POST request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Signup failed with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Signed up successfully!")
    login(client, baseURL, authDetails)
    accessProtectedEndpoint(client, baseURL)
    logout(client, baseURL)
}

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
    "net/http/cookiejar"
)

func main() {
    baseURL := "http://localhost:8000"
    jar, _ := cookiejar.New(nil)
    client := &http.Client{Jar: jar}

    authDetails := map[string]string{
        "username": "johnsmith",
        "password": "testpass123",
    }

    jsonData, _ := json.Marshal(authDetails)
    resp, err := client.Post(fmt.Sprintf("%s/auth/signup", baseURL), "application/json", bytes.NewBuffer(jsonData))
    if err != nil {
        fmt.Println("Error making POST request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Signup failed with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Signed up successfully!")
    login(client, baseURL, authDetails)
    accessProtectedEndpoint(client, baseURL)
    logout(client, baseURL)
}

text

Signed up successfully!

Signed up successfully!

func login(client *http.Client, baseURL string, authDetails map[string]string) {
    jsonData, _ := json.Marshal(authDetails)
    resp, err := client.Post(fmt.Sprintf("%s/auth/login", baseURL), "application/json", bytes.NewBuffer(jsonData))
    if err != nil {
        fmt.Println("Error making POST request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Login failed with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Logged in successfully!")
}

func login(client *http.Client, baseURL string, authDetails map[string]string) {
    jsonData, _ := json.Marshal(authDetails)
    resp, err := client.Post(fmt.Sprintf("%s/auth/login", baseURL), "application/json", bytes.NewBuffer(jsonData))
    if err != nil {
        fmt.Println("Error making POST request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Login failed with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Logged in successfully!")
}

func accessProtectedEndpoint(client *http.Client, baseURL string) {
    req, err := http.NewRequest("GET", fmt.Sprintf("%s/todos", baseURL), nil)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error making GET request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Failed to access protected endpoint with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Accessed todos successfully!")
}

func accessProtectedEndpoint(client *http.Client, baseURL string) {
    req, err := http.NewRequest("GET", fmt.Sprintf("%s/todos", baseURL), nil)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error making GET request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Failed to access protected endpoint with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Accessed todos successfully!")
}

func logout(client *http.Client, baseURL string) {
    req, err := http.NewRequest("POST", fmt.Sprintf("%s/auth/logout", baseURL), nil)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error making POST request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Logout failed with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Logged out successfully!")
}

func logout(client *http.Client, baseURL string) {
    req, err := http.NewRequest("POST", fmt.Sprintf("%s/auth/logout", baseURL), nil)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error making POST request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Logout failed with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Logged out successfully!")
}

text

Failed to access protected endpoint with status: 401 Unauthorized

Failed to access protected endpoint with status: 401 Unauthorized

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
    "net/http/cookiejar"
)

func main() {
    baseURL := "http://localhost:8000"
    jar, _ := cookiejar.New(nil)
    client := &http.Client{Jar: jar}

    authDetails := map[string]string{
        "username": "johnsmith",
        "password": "testpass123",
    }

    jsonData, _ := json.Marshal(authDetails)
    resp, err := client.Post(fmt.Sprintf("%s/auth/signup", baseURL), "application/json", bytes.NewBuffer(jsonData))
    if err != nil {
        fmt.Println("Error making POST request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Signup failed with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Signed up successfully!")
    login(client, baseURL, authDetails)
    accessProtectedEndpoint(client, baseURL)
    logout(client, baseURL)
}

text

Signed up successfully!

func login(client *http.Client, baseURL string, authDetails map[string]string) {
    jsonData, _ := json.Marshal(authDetails)
    resp, err := client.Post(fmt.Sprintf("%s/auth/login", baseURL), "application/json", bytes.NewBuffer(jsonData))
    if err != nil {
        fmt.Println("Error making POST request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Login failed with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Logged in successfully!")
}

func accessProtectedEndpoint(client *http.Client, baseURL string) {
    req, err := http.NewRequest("GET", fmt.Sprintf("%s/todos", baseURL), nil)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error making GET request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Failed to access protected endpoint with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Accessed todos successfully!")
}

func logout(client *http.Client, baseURL string) {
    req, err := http.NewRequest("POST", fmt.Sprintf("%s/auth/logout", baseURL), nil)
    if err != nil {
        fmt.Println("Error creating request:", err)
        return
    }

    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error making POST request:", err)
        return
    }
    defer resp.Body.Close()

    if resp.StatusCode != http.StatusOK {
        fmt.Printf("Logout failed with status: %s\n", resp.Status)
        return
    }

    fmt.Println("Logged out successfully!")
}

text

Failed to access protected endpoint with status: 401 Unauthorized

Introduction to Session-Based Authentication

Understanding Session-Based Authentication

Managing Sessions with Go

Join the 1M+ learners on CodeSignal

Why Use http.CookieJar?

Step 1: Signing Up

Step 2: Logging In

Step 3: Accessing Protected Endpoints

Step 4: Ending the Session with Logging Out

Attempting to Access Protected Endpoints After Logout

Summary and Preparation for Practice