Protecting All API Methods with Authentication

Introduction to API Authentication

Welcome to this lesson, where we will explore how to protect all API methods using authentication . In previous lessons, you have learned how to implement user registration and login functionalities, which are crucial for managing user access. Now, we will focus on enhancing the security of our ToDo app by ensuring that only authenticated users can access the API endpoints. Authentication prevents unauthorized users from accessing and manipulating data, which is vital for application integrity and user privacy. By the end of this lesson, you'll be equipped to safeguard your application methods using authentication techniques.

JWT (JSON Web Tokens) Basics

JSON Web Tokens (JWT) are a popular way to securely transmit information between two parties—such as a client (browser or mobile app) and a server—over the internet. JWTs are most commonly used for authentication: after a user logs in, the server gives them a token, and the user includes this token in future requests to prove who they are. Think of a JWT as a digital “ID card” for your users. When a user logs in successfully, the server creates a JWT and gives it to the user. The user then shows this “ID card” (the JWT) every time they want to access protected parts of your app. The server can quickly check if the “ID card” is valid and hasn't been tampered with, without needing to look up the user in a database every time. Practically, a JWT is a compact, URL-safe string made up of three parts, separated by dots (.): Header : Contains metadata about how the token is encoded and signed (for example, which algorithm is used). Payload : Carries the actual data you want to transmit (e.g., username), called "claims". Claims are statements about an entity (typically, the user) and additional data. There are three types of claims: Registered Claims : Predefined claims such as iss (issuer), exp (expiration time), and sub (subject). Public Claims : Custom claims that you define and register for public use. Private Claims : Custom claims agreed upon between parties sharing the JWT. Signature : A cryptographic signature that makes sure the token hasn't been changed. The server uses a secret key to create this signature. JWT is favored for API security because it allows stateless authentication, meaning the server doesn't need to store every token it issues. This makes JWT efficient and scalable for modern applications.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Creating a JWT

To create a JWT, you typically follow these steps:

Define Claims: Start by determining the claims, such as user information or permissions, that you want to include in the payload.
Create the Header: Specify the token's type (JWT) and the signing algorithm, such as HS256.
Sign the Token: Encode the header and payload to Base64Url format. Then, concatenate them with a period (.) separator, and sign the resulting string using a secret key.
Form the JWT: Combine the encoded header, payload, and signature with periods (.) to form the complete JWT.

Let's see how we can extend our Login service so that it makes use of JWT authentication:

package services

import (
    "time"

    "github.com/golang-jwt/jwt/v5"
)

// Secret key for signing the JWT. 
// This is a simplification for demonstration purposes - in reality, it should be kept safe and secure and not available as plain text in the code.
var jwtSecret = []byte("your-secret-key")

func LoginUser(db *gorm.DB, username string, password string) (string, error) {
    // Validate login credentials
    if err := user_repository.ValidateUser(db, username, password); err != nil {
        return "", err
    }
    // Define claims, which include a username and an expiration time 24 hours from now.
    claims := jwt.MapClaims{
        "username": username,
        "exp":      time.Now().Add(time.Hour * 24).Unix(), // Expiration time 24 hours from current time
    }

    // Create a new JWT token with the specified claims, using the HS256 signing method.
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

    // Sign the token using the secret key and return the signed token string.
    return token.SignedString(jwtSecret)
}

package services

import (
    "time"

    "github.com/golang-jwt/jwt/v5"
)

// Secret key for signing the JWT. 
// This is a simplification for demonstration purposes - in reality, it should be kept safe and secure and not available as plain text in the code.
var jwtSecret = []byte("your-secret-key")

func LoginUser(db *gorm.DB, username string, password string) (string, error) {
    // Validate login credentials
    if err := user_repository.ValidateUser(db, username, password); err != nil {
        return "", err
    }
    // Define claims, which include a username and an expiration time 24 hours from now.
    claims := jwt.MapClaims{
        "username": username,
        "exp":      time.Now().Add(time.Hour * 24).Unix(), // Expiration time 24 hours from current time
    }

    // Create a new JWT token with the specified claims, using the HS256 signing method.
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

    // Sign the token using the secret key and return the signed token string.
    return token.SignedString(jwtSecret)
}

Clearly, the controller function attached to the /login endpoint that makes use of this LoginUser service must return the token in the response; that is:

token, err := services.LoginUser(db, temp.Username, temp.Password)
c.JSON(http.StatusOK, gin.H{"token": token})

token, err := services.LoginUser(db, temp.Username, temp.Password)
c.JSON(http.StatusOK, gin.H{"token": token})

The validation of a JWT ensures that it hasn't been tampered with and is issued by a trusted source. During validation, the following process is carried out:

Extract the Token: Retrieve the JWT from the request header.
Decode the JWT: Split the JWT into header, payload, and signature.
Verify the Signature: Recompute the signature using the stored secret key and compare it with the received signature.
Check Claims: Examine the payload claims for validity, such as checking the expiration time (exp) to ensure the token isn't expired.

Validation is a critical step in securing your API endpoints, confirming that the incoming requests are from an authenticated user.

Implementing JWT authentication requires attention to security best practices to mitigate potential risks.

Keep Secrets Safe: Ensure that your secret keys are stored securely and not exposed in your codebase or logs.
Use Strong Algorithms: Prefer algorithms like HS256 or RS256 for signing to provide strong encryption.
Set Expiration Times: Include an exp claim to prevent tokens from being used indefinitely and protect against replay attacks.
Validate Token Audience and Issuer: Use aud and iss claims to verify the token's audience and issuer, ensuring it was delivered to the intended recipient and issued by a trusted source.
Regenerate Tokens Periodically: Regularly rotate and regenerate tokens to limit the window of exposure in case of a compromised token.

By adhering to these practices, you enhance the security of your application while using JWTs for authentication.

Implementing Authentication Middleware

In this section, we will build on your existing knowledge of middleware by implementing an authentication middleware using JWT for our Gin application. This middleware will ensure that all incoming requests are authenticated before they reach the endpoint logic.

Here's a step-by-step implementation of the authentication middleware, located in middleware/auth.go:

package auth

import (
    "net/http"
    "strings"

    "github.com/gin-gonic/gin"
    "github.com/golang-jwt/jwt/v5" // Import JWT package for token handling

    "codesignal.com/todoapp/services"
)

func AuthMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        // Retrieve the Authorization header from the request
        authHeader := c.GetHeader("Authorization")
        if authHeader == "" {
            // Respond with unauthorized if header is empty
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Authorization header is empty"})
            c.Abort()
            return
        }

        // Split the header's Bearer token
        tokenParts := strings.Split(authHeader, "Bearer ")
        if len(tokenParts) != 2 {
            // Respond with unauthorized if token format is incorrect
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token format"})
            c.Abort()
            return
        }

        // Extract the token string
        tokenString := tokenParts[1]
        claims := &services.Claims{}

        // Parse and validate the JWT using the provided secret key
        token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
            return services.JWTSecret, nil
        })
        if err != nil || !token.Valid {
            // Respond with unauthorized if token is invalid
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
            c.Abort()
            return
        }

        // Set the username in the context for access in subsequent handlers
        c.Set("username", claims.Username)
        c.Next() // Proceed to the next handler if token is valid
    }
}

package auth

import (
    "net/http"
    "strings"

    "github.com/gin-gonic/gin"
    "github.com/golang-jwt/jwt/v5" // Import JWT package for token handling

    "codesignal.com/todoapp/services"
)

func AuthMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        // Retrieve the Authorization header from the request
        authHeader := c.GetHeader("Authorization")
        if authHeader == "" {
            // Respond with unauthorized if header is empty
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Authorization header is empty"})
            c.Abort()
            return
        }

        // Split the header's Bearer token
        tokenParts := strings.Split(authHeader, "Bearer ")
        if len(tokenParts) != 2 {
            // Respond with unauthorized if token format is incorrect
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token format"})
            c.Abort()
            return
        }

        // Extract the token string
        tokenString := tokenParts[1]
        claims := &services.Claims{}

        // Parse and validate the JWT using the provided secret key
        token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
            return services.JWTSecret, nil
        })
        if err != nil || !token.Valid {
            // Respond with unauthorized if token is invalid
            c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
            c.Abort()
            return
        }

        // Set the username in the context for access in subsequent handlers
        c.Set("username", claims.Username)
        c.Next() // Proceed to the next handler if token is valid
    }
}

In this code, we perform the following steps using specific functions:

Gather the Authorization header using c.GetHeader("Authorization").
Split the header to extract the token with strings.Split() and validate its presence.
Parse the token using jwt.ParseWithClaims(), which verifies its authenticity and extracts the claims.
If the token is invalid or missing, respond with an unauthorized error using c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"}).
If valid, set the user's username in the context using c.Set("username", claims.Username) to make it accessible to other handlers.

Securing API Routes with Middleware

With our middleware ready, we'll now apply it to our API routes to safeguard them. Here's how the routes are defined and registered in todoapp/router/router.go:

package router

import (
    "github.com/gin-gonic/gin"

    "codesignal.com/todoapp/controllers"
    "codesignal.com/todoapp/middleware/auth"
    "codesignal.com/todoapp/repositories/db"
)

func RegisterRoutes() *gin.Engine {
    database := db.ConnectDatabase()

    router := gin.Default()
    router.POST("/register", func(c *gin.Context) { controllers.Register(c, database) })
    router.POST("/login", func(c *gin.Context) { controllers.Login(c, database) })

    protected := router.Group("/api", auth.AuthMiddleware())
    {
        protected.GET("/todos", func(c *gin.Context) { controllers.GetTodos(c, database) })
        protected.POST("/todos", func(c *gin.Context) { controllers.CreateTodo(c, database) })
    }
    return router
}

package router

import (
    "github.com/gin-gonic/gin"

    "codesignal.com/todoapp/controllers"
    "codesignal.com/todoapp/middleware/auth"
    "codesignal.com/todoapp/repositories/db"
)

func RegisterRoutes() *gin.Engine {
    database := db.ConnectDatabase()

    router := gin.Default()
    router.POST("/register", func(c *gin.Context) { controllers.Register(c, database) })
    router.POST("/login", func(c *gin.Context) { controllers.Login(c, database) })

    protected := router.Group("/api", auth.AuthMiddleware())
    {
        protected.GET("/todos", func(c *gin.Context) { controllers.GetTodos(c, database) })
        protected.POST("/todos", func(c *gin.Context) { controllers.CreateTodo(c, database) })
    }
    return router
}

Here's what happens in the code:

A protected group is created using router.Group. In Gin, a Group is a way to apply common middleware or path prefixes to a set of routes; for example, in the code snippet both routes share the common /api prefix as well as the AuthMiddleware authentication middleware as they belong to the same protected group.
We define our GET /todos and POST /todos routes within this protected group, ensuring they are only accessible to authenticated users.
Unauthorized requests will be blocked at the middleware stage, never reaching the business logic of these endpoints.

Congratulations on completing this lesson! You have learned how to implement JWT-based authentication to protect your API methods using the Gin framework. By creating authentication middleware and integrating it with your route definitions, you set a strong foundation for safeguarding your application.

As you move forward, practical exercises will reinforce this knowledge by having you implement and test these concepts. Continue to explore how authentication can fortify the integrity and security of your applications.

Introduction to API Authentication

JWT (JSON Web Tokens) Basics

Join the 1M+ learners on CodeSignal

Creating a JWT

Validating a JWT

JWT Security Best Practices

Implementing Authentication Middleware

Securing API Routes with Middleware

Summary and Next Steps