Building an Authentication Service

Overview

Building an authentication service involves creating a system to manage user identities, authenticate users, and issue tokens for secure access to other services. This chapter will guide you through the process of designing and implementing an authentication service in Go.

1. Introduction to Authentication

1.1 Understanding Authentication and Authorization:

• Authentication: The process of verifying the identity of a user or service.
• Authorization: The process of determining whether an authenticated user has permission to perform a certain action.

1.2 Types of Authentication:

• Basic Authentication: Simple user credentials (username and password).
• Token-Based Authentication: More secure, uses tokens (e.g., JWT) instead of credentials.
• OAuth2: A standard for delegated authorization.

2. Setting Up the Project

2.1 Initializing the Project:

• Create a new Go module for your authentication service.

sh
mkdir auth-service
cd auth-service
go mod init github.com/yourusername/auth-service

2.2 Adding Dependencies:

• Use Go modules to manage dependencies.

sh
go get github.com/dgrijalva/jwt-go
go get github.com/gorilla/mux
go get golang.org/x/crypto/bcrypt

3. Designing the Authentication Service

3.1 Defining User Model:

• Create a User struct to represent user data.

go
package models

type User struct {
    ID       string `json:"id"`
    Username string `json:"username"`
    Password string `json:"-"`
}

3.2 Setting Up Database:

• Use an appropriate database (e.g., PostgreSQL) to store user data.
• Create a user table with fields for ID, username, and hashed password.

3.3 Implementing User Registration:

• Create an endpoint to handle user registration.
• Hash user passwords before storing them.

go
package handlers

import (
    "encoding/json"
    "net/http"
    "golang.org/x/crypto/bcrypt"
    "github.com/yourusername/auth-service/models"
)

func Register(w http.ResponseWriter, r *http.Request) {
    var user models.User
    json.NewDecoder(r.Body).Decode(&user)
    hashedPassword, _ := bcrypt.GenerateFromPassword([]byte(user.Password), bcrypt.DefaultCost)
    user.Password = string(hashedPassword)
    // Save user to the database
    json.NewEncoder(w).Encode(user)
}

3.4 Implementing User Login:

• Verify user credentials and generate a JWT token upon successful login.

go
package handlers

import (
    "encoding/json"
    "net/http"
    "time"
    "github.com/dgrijalva/jwt-go"
    "golang.org/x/crypto/bcrypt"
    "github.com/yourusername/auth-service/models"
)

var jwtKey = []byte("your_secret_key")

type Claims struct {
    Username string `json:"username"`
    jwt.StandardClaims
}

func Login(w http.ResponseWriter, r *http.Request) {
    var user models.User
    json.NewDecoder(r.Body).Decode(&user)
    // Retrieve user from the database
    storedUser, err := getUserFromDB(user.Username)
    if err != nil || bcrypt.CompareHashAndPassword([]byte(storedUser.Password), []byte(user.Password)) != nil {
        http.Error(w, "Invalid credentials", http.StatusUnauthorized)
        return
    }
    expirationTime := time.Now().Add(24 * time.Hour)
    claims := &Claims{
        Username: user.Username,
        StandardClaims: jwt.StandardClaims{
            ExpiresAt: expirationTime.Unix(),
        },
    }
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
    tokenString, err := token.SignedString(jwtKey)
    if err != nil {
        http.Error(w, "Internal server error", http.StatusInternalServerError)
        return
    }
    http.SetCookie(w, &http.Cookie{
        Name:    "token",
        Value:   tokenString,
        Expires: expirationTime,
    })
}

4. Token Management

4.1 JWT Token Generation:

• Use JWT (JSON Web Tokens) for secure and stateless authentication.
• Generate tokens upon successful user login.

4.2 Token Validation Middleware:

• Create middleware to validate JWT tokens on protected routes.

go
package middleware

import (
    "net/http"
    "github.com/dgrijalva/jwt-go"
)

func AuthMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        cookie, err := r.Cookie("token")
        if err != nil {
            if err == http.ErrNoCookie {
                http.Error(w, "Unauthorized", http.StatusUnauthorized)
                return
            }
            http.Error(w, "Bad request", http.StatusBadRequest)
            return
        }
        tokenStr := cookie.Value
        claims := &Claims{}
        token, err := jwt.ParseWithClaims(tokenStr, claims, func(token *jwt.Token) (interface{}, error) {
            return jwtKey, nil
        })
        if err != nil {
            if err == jwt.ErrSignatureInvalid {
                http.Error(w, "Unauthorized", http.StatusUnauthorized)
                return
            }
            http.Error(w, "Bad request", http.StatusBadRequest)
            return
        }
        if !token.Valid {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        next.ServeHTTP(w, r)
    })
}

5. Security Best Practices

5.1 Secure Password Storage:

• Always hash passwords using bcrypt before storing them.

5.2 Secure Token Storage:

• Use secure cookies or HTTP headers to store JWT tokens.

5.3 Regular Token Rotation:

• Implement token expiration and refresh tokens to enhance security.

6. Testing and Deployment

6.1 Unit Testing:

• Write tests for user registration, login, and middleware functions.

go
package handlers_test

import (
    "testing"
    "net/http"
    "net/http/httptest"
    "bytes"
    "encoding/json"
    "github.com/yourusername/auth-service/models"
)

func TestRegister(t *testing.T) {
    user := models.User{Username: "testuser", Password: "password"}
    body, _ := json.Marshal(user)
    req, _ := http.NewRequest("POST", "/register", bytes.NewBuffer(body))
    rr := httptest.NewRecorder()
    handler := http.HandlerFunc(Register)
    handler.ServeHTTP(rr, req)
    if status := rr.Code; status != http.StatusOK {
        t.Errorf("handler returned wrong status code: got %v want %v", status, http.StatusOK)
    }
}

6.2 Continuous Integration and Deployment:

• Use CI/CD tools like GitHub Actions, Jenkins, or Travis CI to automate testing and deployment.
• Ensure secure handling of secrets and environment variables during deployment.