0

We've been using github.com/dgrijalva/jwt-go for JWT-related processing in Go, however this project is clearly no longer maintained (last commit Jan. 2020, 87 open issues, explicit remarks from the community).

I would like recommendations for an alternative library to migrate my projects to.

I don't have unusual requirements. These are some points I'm looking for in a replacement candidate:

  • sign and validate tokens (we use HMAC+SHA256)
  • support custom claims
  • support/allow custom aud
  • allow to defer/skip validation (don't jump on the chair, I have a legit use case for this)

Additional requirements:

  • it should be actively maintained and/or not have (an unreasonable amount of) open bugs, this is one of the main reasons I'm thinking to switch in the first place
  • properly support Go modules (no vX.Y.Z+incompatible in my go.mod)

The following are code snippets that illustrate how I'm using my current JWT lib.

// custom claims example
        token, err := jwt.ParseWithClaims(tokenString, &MyClaims{}, func(token *jwt.Token) (interface{}, error) {
            if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
                msg := "unexpected signing method"
                logger.Error(msg)
                return nil, errors.New(msg)
            }
            return []byte(jwtSecret), nil
        })
// signing algo example
func (a *authorizer) jwtWithClientApp() *jwt.Token {
    if a.options.apiKey == "" {
        panic(...)
    }
    scope := "restricted"
    if a.options.scope != "" {
        scope = a.options.scope
    }

    return jwt.NewWithClaims(
        jwt.SigningMethodHS256,
        MyClaims{
            Scope: scope,
            ClientApp: &ClientApp{
                APIKey: a.options.apiKey,
                Name:   a.issuer,
            },
            StandardClaims: jwt.StandardClaims{
                ExpiresAt: time.Now().Add(a.options.expiry).UTC().Unix(),
                Issuer:    a.issuer,
                Subject:   a.options.apiKey,
            },
        },
    )
}
// defer/skip validation example
    parser := &jwt.Parser{}
    tok, _, err := parser.ParseUnverified(string(jwtaccess), &jwt.StandardClaims{})
    if err != nil {
        return "", -1, errors.Wrap(err, "failed to parse token")
    }
0
+100

There are

Both seem to be actively maintained and the second one is backed by the company Square, Inc.

If these don't fulfill your requirements please exclude them in your question.

2
  • Thanks! When I did my due diligence, https://github.com/square/go-jose seemed actually not maintained – blackgreen Mar 26 at 10:11
  • I decided to go with lestrrat-go/jwx, it's a pretty good lib and it seems actively maintained. Can't upvote tho bc I have no more rep... >.< – blackgreen Mar 29 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.