gin-jwt

Gin JWT Middleware provides:

• Simple JWT authentication for the Gin web framework.
• Built-in handlers for login, refresh, and logout.
• Customizable authentication, authorization, and claims.
• Support for both Cookie and Header-based tokens.
• RFC 6749 compliant refresh tokens (OAuth 2.0 standard) with automatic rotation.
• Pluggable refresh token storage (In-memory or Redis).
• Direct token generation capabilities without requiring HTTP middleware.
• Structured Token type with metadata.

gin-jwt is a powerful and flexible JWT authentication middleware for the Gin web framework, implemented based on golang-jwt/jwt.

Key Features:

• Simple JWT authentication for Gin.
• Built-in handlers for Login, Refresh, and Logout.
• Customizable authentication, authorization, and Claims.
• Supports both Cookie and Header-based tokens.
• Follows RFC 6749 OAuth 2.0 standards for Refresh Tokens (using opaque tokens and server-side storage).
• Pluggable Refresh Token storage (Memory, Redis client cache).
• Ability to generate tokens directly without HTTP middleware.
• Structured token types and metadata.

For production Azure AD integration, do not hardcode keys. Implement a provider that dynamically fetches and caches public keys from the Azure AD JWKS endpoint (e.g., https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys).

Best Practices:

• Dynamic Fetching: Use a library like github.com/lestrrat-go/jwx/v2/jwk to parse JWKS.
• Caching: Store keys in memory to avoid latency on every request.
• Automatic Rotation: Run a background goroutine with a time.Ticker to refresh keys periodically (e.g., every hour) to handle key rotation.

type AzureADKeyProvider struct {
    jwksURL    string
    keys       map[string]*rsa.PublicKey
    mutex      sync.RWMutex
    lastUpdate time.Time
}

// RefreshKeys fetches new keys from the JWKS endpoint
func (p *AzureADKeyProvider) RefreshKeys() error {
    // ... implementation using jwk.Fetch ...
}

To accept JWT tokens from multiple sources (e.g., your own system and external providers like Azure AD, Auth0, or Google), use a single middleware instance configured with a dynamic KeyFunc callback. This allows you to inspect the token's claims (such as the iss issuer claim) before validation and select the appropriate signing key or method dynamically.

Key Benefits:

• Supports hybrid authentication (internal + external).
• Enables seamless migration between authentication systems.
• Avoids the issues of chaining multiple middlewares where the first failure might abort the request.

Install the gin-jwt/v3 package using Go modules. Requires Go 1.24+.

go get -u github.com/appleboy/gin-jwt/v3

You can use Redis as the backend store for refresh tokens using several convenience methods on the *jwt.GinJWTMiddleware instance. If the Redis connection fails, the middleware automatically falls back to an in-memory store to ensure high availability.

// Method 1: Default Configuration
middleware := &jwt.GinJWTMiddleware{
    // ... other configuration
    UseRedisStore: true,
}
// Or using convenience method
middleware.EnableRedisStore()

// Method 2: Custom Address
middleware.EnableRedisStoreWithAddr("localhost:6379")

// Method 3: Full Options (Address, Password, DB)
middleware.EnableRedisStoreWithOptions("localhost:6379", "password", 0)

// Method 4: Custom Configuration object
config := store.DefaultRedisConfig()
config.Addr = "localhost:6379"
config.CacheSize = 128 * 1024 * 1024 // 128MB
middleware.EnableRedisStoreWithConfig(config)

The repository provides several specialized implementation examples:

• Basic Authentication: Standard JWT flow with login, protected routes, and token verification.
• OAuth 2.0 SSO Integration: Supports Google and GitHub using the Authorization Code flow, CSRF protection via state tokens, and dual-authentication (httpOnly cookies + Authorization headers).
• Token Generator: A way to generate JWT tokens programmatically without using the HTTP middleware (useful for service-to-service communication or testing).
• Redis Storage: Demonstrates integrating Redis for managing refresh tokens, including client-side caching and automatic fallback to in-memory storage.
• Authorization Control: Advanced patterns including Role-Based Access Control (RBAC), path-based authorization, and managing multiple middleware instances.