jwt-go VS goth

My only suggestion, because I haven't seen anyone else mention it, is researching your dependencies. In the app you're using https://github.com/dgrijalva/jwt-go, which isn't maintained anymore and in their repo they state that you should use https://github.com/golang-jwt/jwt instead.

There are so many tools created tools using golang like the gh-cli, cockrach-db, jwt, etc. You can see a whole list of applications/tools/frameworks written in Go from this awesome list

If it is using "github.com/golang-jwt/jwt" under the hood than all you have to do is override the Valid() method on your claims object.

The code logic is query user record from database by input parameter username, if not found, return Incorrect username or password error, if password was correct, issue token. The jwt library used here is golang-jwt/jwt

Abandon https://github.com/dgrijalva/jwt-go library due security issues. Now I use https://github.com/golang-jwt/jwt#jwt-go

Use jwt (jwt.io, https://github.com/golang-jwt/jwt) shoveling the params into a MapClaims.

Go JWT Implementation Link

The boilerplate application uses the dgrijalva / jwt-go library to work with JWTs. Besides the standard set of claims fields, this library allows you to describe additional fields. In the application, this makes it possible to write to the token the ID of the user to whom it was issued. The library supports the NewWithClaims () and Parse () functions used in the AuthHandler application to create and validate tokens. Also, the Echo framework has a JWT middleware that uses the specified library to validate tokens. This middleware is hooked up in the ConfigureRoutes () function of the template application that declares the routing.

There might be many different packages, but I think this one is the most popular: https://github.com/dgrijalva/jwt-go. So let’s copy its URL, and run go get in the terminal to install the package:

Also really easy to implement as there are libraries that do all the heavy lifting for you (https://github.com/markbates/goth is a great starting place IMHO)

In the package 'markbates/goth' that provides a client implementation of OAuth 2.0, the authors have defined the function CompleteUserAuth at the package level like this:

You can use oauth2. Just take e.g. a look at the dex documentation dex. Dex is not a library but a standalone federated oidc provider. Highly recommended. For libraries take a look at goth.

For the kind of websites I prefer to build -- server side rendered with HTMX/Alpine for the extra niceness -- Rust I think could be a very good fit. The main downside for my personal projects is the ecosystem. E.g., a good standard way to handle CSRF tokens, standardised oauth2 implementations (like https://github.com/markbates/goth in Go), things like that. I found myself having to write a lot of code that just exists in the Go ecosystem. The main downside for a business is that it's going to make it harder to hire, since Rust genuinely requires more skill. Yes, developers will make mistakes in Go, as it's far too easy to do things like access shared memory in dangerous ways. But on the flip side, it's a lot easier for them to deliver a feature. In a choice between shipping a feature that is buggy in hard to detect ways, vs not being able to deliver at all because you can't get developers, I think it's better to ship.