Go实战--通过basic认证的http(basic authentication)
生命不止， 继续 go go go !!!
之前写过相关博客：
Go实战–go中使用base64加密(The way to go)
Go实战–实现简单的restful api(The way to go)
今天就跟大家介绍一下带有basic认证的api。
何为basic authentication
In the context of a HTTP transaction, basic access authentication is a method for a HTTP user agent to provide a user name and password when making a request.
但是这种认证方式有很多的缺点：
虽然基本认证非常容易实现，但该方案建立在以下的假设的基础上，即：客户端和服务器主机之间的连接是安全可信的。特别是，如果没有使用SSL/TLS这样的传输层安全的协议，那么以明文传输的密钥和口令很容易被拦截。该方案也同样没有对服务器返回的信息提供保护。
请各位大大稍安勿躁，今天我们先介绍一下go中使用basic认证，之后会跟大家介绍更安全的认证方式 auth2.0.
那么如何进行base64加密解密之前介绍过了：
package main
import (
"encoding/base64"
"fmt"
)
func main() {
s := "heal the world, make it a better place"
encodeStd := "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
s64 := base64.NewEncoding(encodeStd).EncodeToString([]byte(s))
fmt.Println("base64.NewEncoding(encodeStd).EncodeToString")
fmt.Println(len(s))
fmt.Println(len(s64))
fmt.Println(s)
fmt.Println(s64)
s64_std := base64.StdEncoding.EncodeToString([]byte(s))
fmt.Println("base64.StdEncoding.EncodeToString")
fmt.Println(len(s))
fmt.Println(len(s64_std))
fmt.Println(s)
fmt.Println(s64_std)
}basic 认证形如：
Authorization: Basic ZGVtbzpwQDU1dzByZA==
简单的basic认证
strings.SplitN
记忆中，没有详细介绍过strings package，这里就啰嗦这一个方法：
func SplitN(s, sep string, n int) []stringSplitN slices s into substrings separated by sep and returns a slice of the substrings between those separators. If sep is empty, SplitN splits after each UTF-8 sequence.
看到了吗，golang中的strings包为我们提供了强大的字符串处理能力。
package main
import (
"encoding/base64"
"net/http"
"strings"
)
func checkAuth(w http.ResponseWriter, r *http.Request) bool {
s := strings.SplitN(r.Header.Get("Authorization"), " ", 2)
if len(s) != 2 {
return false
}
b, err := base64.StdEncoding.DecodeString(s[1])
if err != nil {
return false
}
pair := strings.SplitN(string(b), ":", 2)
if len(pair) != 2 {
return false
}
return pair[0] == "user" && pair[1] == "pass"
}
func main() {
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
if checkAuth(w, r) {
w.Write([]byte("hello world!"))
return
}
w.Header().Set("WWW-Authenticate", `Basic realm="MY REALM"`)
w.WriteHeader(401)
w.Write([]byte("401 Unauthorized\n"))
})
http.ListenAndServe(":8080, nil)
}
通过postman进行访问：
通过第三方完成basic认证
github.com/ant0ine/go-json-rest/rest
Go-Json-Rest is a thin layer on top of net/http that helps building RESTful JSON APIs easily. It provides fast and scalable request routing using a Trie based implementation, helpers to deal with JSON requests and responses, and middlewares for functionalities like CORS, Auth, Gzip, Status …
star:2810
go get -u github.com/ant0ine/go-json-rest/rest应用：
package main
import (
"log"
"net/http"
"github.com/ant0ine/go-json-rest/rest"
)
func main() {
api := rest.NewApi()
api.Use(rest.DefaultDevStack...)
api.Use(&rest.AuthBasicMiddleware{
Realm: "my realm",
Authenticator: func(userId string, password string) bool {
if userId == "user" && password == "pass" {
return true
}E
return false
},
})
api.SetApp(rest.AppSimple(func(w rest.ResponseWriter, r *rest.Request) {
w.WriteJson(map[string]string{"Body": "Hello World!"})
}))
log.Fatal(http.ListenAndServe(":8080", api.MakeHandler()))
}通过postman进行访问：
