Alternative to github.com/dgrijalva/jwt-go for JWT in Go

Question

We've been using github.com/dgrijalva/jwt-go for JWT-related processing in Go, however this project is clearly no longer maintained (last commit Jan. 2020, 87 open issues, explicit remarks from the community).

I would like recommendations for an alternative library to migrate my projects to.

I don't have unusual requirements. These are some points I'm looking for in a replacement candidate:

• sign and validate tokens (we use HMAC+SHA256)
• support custom claims
• support/allow custom aud
• allow to defer/skip validation (don't jump on the chair, I have a legit use case for this)

Additional requirements:

• it should be actively maintained and/or not have (an unreasonable amount of) open bugs, this is one of the main reasons I'm thinking to switch in the first place
• properly support Go modules (no vX.Y.Z+incompatible in my go.mod)

The following are code snippets that illustrate how I'm using my current JWT lib.

// custom claims example
        token, err := jwt.ParseWithClaims(tokenString, &MyClaims{}, func(token *jwt.Token) (interface{}, error) {
            if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
                msg := "unexpected signing method"
                logger.Error(msg)
                return nil, errors.New(msg)
            }
            return []byte(jwtSecret), nil
        })

// signing algo example
func (a *authorizer) jwtWithClientApp() *jwt.Token {
    if a.options.apiKey == "" {
        panic(...)
    }
    scope := "restricted"
    if a.options.scope != "" {
        scope = a.options.scope
    }

    return jwt.NewWithClaims(
        jwt.SigningMethodHS256,
        MyClaims{
            Scope: scope,
            ClientApp: &ClientApp{
                APIKey: a.options.apiKey,
                Name:   a.issuer,
            },
            StandardClaims: jwt.StandardClaims{
                ExpiresAt: time.Now().Add(a.options.expiry).UTC().Unix(),
                Issuer:    a.issuer,
                Subject:   a.options.apiKey,
            },
        },
    )
}

// defer/skip validation example
    parser := &jwt.Parser{}
    tok, _, err := parser.ParseUnverified(string(jwtaccess), &jwt.StandardClaims{})
    if err != nil {
        return "", -1, errors.Wrap(err, "failed to parse token")
    }

Answer 1

There are

• https://github.com/lestrrat-go/jwx
• https://github.com/square/go-jose

Both seem to be actively maintained and the second one is backed by the company Square, Inc.

If these don't fulfill your requirements please exclude them in your question.