appleboy / appleboy/gin-jwt

Assymmetric key validation should have to use private key file

Open
#236 2 comments 8 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
3k
Forks
387
Avg merge
4h 16m
Merged PRs (30d)
1

Description

I am trying to implement an asymmetric validation middleware that uses RS256. In theory this should only need the public key to verify the JWT, but not including the private key does not work. I do not want to include the private key with the project. Below is my implementation.
`
authMiddleware, _ := app.New(&app.GinJWTMiddleware {

Realm: "zone",
SigningAlgorithm: "RS256",
PrivKeyFile: "keys/jwtRS256.key",
PubKeyFile: "keys/jwtRS256.key.pub",

PayloadFunc: func(data interface{}) app.MapClaims {
if v, ok := data.(*JWTToken); ok {
return app.MapClaims{
userName: v.UserName,
}
}
return app.MapClaims{}
},

IdentityHandler: func(c *gin.Context) interface{} {
claims := app.ExtractClaims(c)
return &JWTToken{
UserName: claims[userName].(string),
TokenType: claims[tokenType].(string),
}
},

Authorizator: func(data interface{}, c *gin.Context) bool {
if v, ok := data.(*JWTToken); ok && v.UserName == "admin" {
return true
}

return false
},

Unauthorized: func(c *gin.Context, code int, message string) {
c.JSON(code, gin.H{
"code": code,
"message": message,
})
},

TokenLookup: "header: Authorization, query: token, cookie: jwt",
TokenHeadName: "Bearer",
TimeFunc: time.Now,
})`

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the app.New GinJWTMiddleware configuration shown in the issue and reproduce RS256 validation with only PubKeyFile configured. Trace how the middleware loads and uses the key files during validation; the issue is complete when public-key-only verification works without requiring the private key file.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.