Documentation
¶
Overview ¶
Package auth provides session-based and JWT authentication for OniWorks. Session auth is the default. JWT is opt-in for API-only applications.
Index ¶
- Variables
- func CheckPassword(hash, password string) bool
- func HashPassword(password string, cost ...int) (string, error)
- type Claims
- type Guard
- func (g *Guard) Attempt(ctx context.Context, email, password string, sess *session.Session) (User, error)
- func (g *Guard) Check(ctx context.Context, sess *session.Session) bool
- func (g *Guard) IssueToken(user User, ttl time.Duration) (string, error)
- func (g *Guard) Logout(ctx context.Context, sess *session.Session) error
- func (g *Guard) ParseToken(tokenStr string) (*Claims, error)
- func (g *Guard) UserFromSession(ctx context.Context, sess *session.Session) (User, error)
- func (g *Guard) UserFromToken(ctx context.Context, tokenStr string) (User, error)
- type User
- type UserProvider
Constants ¶
This section is empty.
Variables ¶
var ( ErrInvalidCredentials = errors.New("auth: invalid email or password") ErrInvalidToken = errors.New("auth: invalid or expired token") ErrUnauthenticated = errors.New("auth: unauthenticated") // ErrJWTNotConfigured is returned when a JWT operation is attempted but no // (or too short a) signing secret was provided to NewGuard. An empty secret // would let anyone forge tokens, so JWT operations fail closed. ErrJWTNotConfigured = errors.New("auth: JWT secret not configured (must be at least 32 bytes)") )
Functions ¶
func CheckPassword ¶
CheckPassword verifies a plaintext password against a bcrypt hash.
func HashPassword ¶
HashPassword bcrypt-hashes a plaintext password. An optional cost may be supplied (bcrypt.MinCost..bcrypt.MaxCost); it defaults to bcrypt.DefaultCost.
auth.HashPassword("s3cret") // default cost
auth.HashPassword("s3cret", 12) // explicit cost
Types ¶
type Claims ¶
type Claims struct {
UserID int64 `json:"uid"`
Email string `json:"email"`
jwt.RegisteredClaims
}
Claims is the JWT payload.
type Guard ¶
type Guard struct {
// contains filtered or unexported fields
}
Guard manages authentication state for the current request.
func NewGuard ¶
func NewGuard(provider UserProvider, sessions *session.Manager, jwtSecret string) *Guard
NewGuard creates a Guard.
func (*Guard) Attempt ¶
func (g *Guard) Attempt(ctx context.Context, email, password string, sess *session.Session) (User, error)
Attempt verifies credentials and creates an authenticated session on success.
On success the session ID is rotated (Regenerate) to defeat session fixation. When the email is unknown a dummy bcrypt comparison is still performed so the not-found path takes the same time as a wrong-password path, preventing account enumeration via response timing.
func (*Guard) IssueToken ¶
IssueToken creates a signed JWT for the given user.
func (*Guard) Logout ¶
Logout removes the user from the session and rotates the session ID, so the pre-logout session ID (which may have leaked, e.g. in logs or a stolen cookie) can no longer be replayed. This mirrors what Attempt does on login.
func (*Guard) ParseToken ¶
ParseToken validates a JWT and returns the embedded Claims.
It fails closed if the signing secret is unconfigured/too short, restricts the accepted algorithm to HS256 (blocking algorithm-confusion and "alg:none" attacks), and requires the token to carry an expiry so non-expiring tokens are never accepted.
func (*Guard) UserFromSession ¶
UserFromSession retrieves the authenticated user from the session. Returns nil (and no error) if the session has no authenticated user.
Source Files