Pure golang-jwt/jwt/v5 middleware

[aldas]

This is for those who do not want to use this library. Maybe you are worried that we are not that strict on semantic versioning or want something "smaller".

This is example middleware absolutely bare minimum. Just using golang-jwt/jwt/v5 and Echo core

package main

import (
	"github.com/golang-jwt/jwt/v5"
	"github.com/golang-jwt/jwt/v5/request"
	"github.com/labstack/echo/v4"
	"net/http"
)

func JWT(signingKey interface{}) echo.MiddlewareFunc {
	return func(next echo.HandlerFunc) echo.HandlerFunc {
		extractor := request.AuthorizationHeaderExtractor
		keyfunc := func(*jwt.Token) (interface{}, error) {
			return signingKey, nil
		}
		parser := jwt.NewParser(jwt.WithValidMethods([]string{"HS256", "HS384", "HS512"}))

		return func(c echo.Context) error {
			tokenString, err := extractor.ExtractToken(c.Request())
			if err != nil {
				return echo.NewHTTPError(http.StatusBadRequest, "missing or malformed jwt").SetInternal(err)
			}
			token, err := parser.ParseWithClaims(tokenString, jwt.MapClaims{}, keyfunc)
			if err != nil {
				return echo.NewHTTPError(http.StatusUnauthorized, "invalid or expired jwt").SetInternal(err)
			}
			c.Set("user", token)
			return next(c)
		}
	}
}

Test for it

package main

import (
	"github.com/golang-jwt/jwt/v5"
	"github.com/labstack/echo/v4"
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestJWT(t *testing.T) {
	e := echo.New()

	e.GET("/", func(c echo.Context) error {
		token := c.Get("user").(*jwt.Token)
		return c.JSON(http.StatusOK, token.Claims)
	})

	e.Use(JWT([]byte("secret")))

	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.Header.Set(echo.HeaderAuthorization, "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ")
	res := httptest.NewRecorder()
	e.ServeHTTP(res, req)

	if res.Code != http.StatusOK {
		t.Fatal("invalid response code")
	}
	if res.Body.String() != `{"admin":true,"name":"John Doe","sub":"1234567890"}`+"\n" {
		t.Fatal("invalid response body")
	}
}