README
¶
examples/http-minimal
Minimal HTTP integration that demonstrates the goAuth "golden path":
POST /login → obtain access + refresh tokens
POST /refresh → rotate tokens (cookie-based)
POST /logout → destroy session
GET /protected → middleware-guarded route
Run
go run ./examples/http-minimal
No external Redis required — uses miniredis in-process.
Try it
# Login (add "remember":true for a durable session capped by
# Config.Session.MaxSessionDuration)
curl -s -X POST http://localhost:8080/login \
-d '{"username":"alice@example.com","password":"correct-horse","remember":true}' \
-c cookies.txt
# Access a protected route
TOKEN=$(curl -s -X POST http://localhost:8080/login \
-d '{"username":"alice@example.com","password":"correct-horse"}' | jq -r .access_token)
curl -s http://localhost:8080/protected \
-H "Authorization: Bearer $TOKEN"
# Refresh
curl -s -X POST http://localhost:8080/refresh -b cookies.txt -c cookies.txt
# Logout
curl -s -X POST http://localhost:8080/logout \
-H "Authorization: Bearer $TOKEN"
Integration in your project
- Replace
stubProviderwith your real database-backedUserProvider. - Generate Ed25519 keys with
go run ./cmd/goauth-keygen(or usegoAuth.DefaultConfig(), which generates ephemeral keys). SetJWT.KeyIDandJWT.VerifyKeysfrom day one so the key-rotation ceremony in docs/ops.md works without a flag day. - Point
redis.NewClientat your real Redis instance. - Copy the handler patterns and middleware wiring into your router
(
middleware.RequireJWTOnly/RequireHybrid/RequireStrictfor per-route validation modes). - For WebAuthn/FIDO2 second factor, implement
WebAuthnCredentialProvideron your provider and enableConfig.WebAuthn— see docs/webauthn.md.
See docs/api-reference.md for the full API surface.
Documentation
¶
Overview ¶
Package main demonstrates a minimal HTTP integration with goAuth.
It starts a local HTTP server on :8080 backed by miniredis (no external Redis required) and an in-memory user provider stub.
Endpoints:
POST /login — JSON {"username":"...", "password":"...", "remember":true|false}
POST /refresh — rotates tokens via the refresh-token cookie
POST /logout — destroys the current session (by access token)
GET /protected — middleware-guarded route (requires valid access token)
Run:
go run ./examples/http-minimal
Then:
# login (stores refresh cookie in cookie jar)
curl -i -c jar.txt -X POST localhost:8080/login \
-H 'Content-Type: application/json' \
-d '{"username":"alice@example.com","password":"correct-horse"}'
# call protected (uses access token from login response)
curl -i localhost:8080/protected -H "Authorization: Bearer <ACCESS_TOKEN>"
# refresh (uses cookie jar)
curl -i -b jar.txt -c jar.txt -X POST localhost:8080/refresh
# logout (invalidates session by access token, clears refresh cookie)
curl -i -b jar.txt -c jar.txt -X POST localhost:8080/logout \
-H "Authorization: Bearer <ACCESS_TOKEN>"
Source Files
Click to show internal directories.
Click to hide internal directories.