JWT Authentication Middleware for HTTP Servers

package main

import (
	"context"
	"crypto/subtle"
	"encoding/json"
	"errors"
	"fmt"
	"log"
	"net/http"
	"strings"
	"time"

	"github.com/golang-jwt/jwt/v5"
)

type JWTConfig struct {
	SecretKey     []byte
	TokenDuration time.Duration
	Issuer        string
}

type CustomClaims struct {
	UserID string `json:"user_id"`
	Role   string `json:"role"`
	jwt.RegisteredClaims
}

type claimsKey struct{}

func writeJSON(w http.ResponseWriter, status int, v interface{}) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	_ = json.NewEncoder(w).Encode(v)
}

func bearerToken(r *http.Request) (string, error) {
	h := r.Header.Get("Authorization")
	if h == "" {
		return "", errors.New("missing Authorization header")
	}
	parts := strings.Fields(h)
	if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
		return "", errors.New("invalid Authorization header (use: Bearer <token>)")
	}
	return parts[1], nil
}

func JWTMiddleware(cfg JWTConfig) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			tokenString, err := bearerToken(r)
			if err != nil {
				writeJSON(w, http.StatusUnauthorized, map[string]string{"error": err.Error()})
				return
			}

			claims := &CustomClaims{}
			token, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
				if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
					return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
				}
				return cfg.SecretKey, nil
			})
			if err != nil {
				if errors.Is(err, jwt.ErrTokenExpired) {
					writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "token expired"})
					return
				}
				writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid token"})
				return
			}
			if !token.Valid {
				writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "invalid token"})
				return
			}

			ctx := context.WithValue(r.Context(), claimsKey{}, claims)
			next.ServeHTTP(w, r.WithContext(ctx))
		})
	}
}

func RequireRole(requiredRole string) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			claims, ok := r.Context().Value(claimsKey{}).(*CustomClaims)
			if !ok || claims == nil {
				writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "missing claims"})
				return
			}

			if subtle.ConstantTimeCompare([]byte(claims.Role), []byte(requiredRole)) != 1 {
				writeJSON(w, http.StatusForbidden, map[string]string{"error": "insufficient permissions"})
				return
			}

			next.ServeHTTP(w, r)
		})
	}
}

func GenerateToken(cfg JWTConfig, userID, role string) (string, error) {
	now := time.Now()
	claims := CustomClaims{
		UserID: userID,
		Role:   role,
		RegisteredClaims: jwt.RegisteredClaims{
			Issuer:    cfg.Issuer,
			IssuedAt:  jwt.NewNumericDate(now),
			ExpiresAt: jwt.NewNumericDate(now.Add(cfg.TokenDuration)),
		},
	}

	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
	return token.SignedString(cfg.SecretKey)
}

func main() {
	cfg := JWTConfig{
		SecretKey:     []byte("your-strong-secret-key-keep-it-safe-12345"),
		TokenDuration: 24 * time.Hour,
		Issuer:        "example-app",
	}

	adminToken, err := GenerateToken(cfg, "user_123", "admin")
	if err != nil {
		log.Fatalf("generate token: %v", err)
	}
	userToken, _ := GenerateToken(cfg, "user_456", "user")
	log.Printf("Admin token (Authorization: Bearer <token>): %s", adminToken)
	log.Printf("User  token (Authorization: Bearer <token>): %s", userToken)

	mux := http.NewServeMux()
	mux.HandleFunc("/public", func(w http.ResponseWriter, r *http.Request) {
		writeJSON(w, http.StatusOK, map[string]string{"message": "public endpoint"})
	})

	mux.Handle("/protected", JWTMiddleware(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		claims := r.Context().Value(claimsKey{}).(*CustomClaims)
		writeJSON(w, http.StatusOK, map[string]interface{}{
			"message": "protected endpoint",
			"user_id": claims.UserID,
			"role":    claims.Role,
		})
	})))

	mux.Handle("/admin", JWTMiddleware(cfg)(RequireRole("admin")(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		claims := r.Context().Value(claimsKey{}).(*CustomClaims)
		writeJSON(w, http.StatusOK, map[string]interface{}{
			"message": "admin endpoint",
			"user_id": claims.UserID,
		})
	}))))

	log.Println("Server starting on :8080")
	log.Println("Try:")
	log.Println("  curl http://localhost:8080/public")
	log.Println("  curl -H "Authorization: Bearer <TOKEN>" http://localhost:8080/protected")
	log.Fatal(http.ListenAndServe(":8080", mux))
}