|
1 | 1 | # HTTP Authentication |
2 | 2 | Authentication is a crucial aspect of web applications, controlling access to resources based on user roles or permissions. |
3 | | -Authentication is the process of verifying a user's identity to grant access to protected resources. It ensures only |
4 | | -authorized users can perform certain actions or access sensitive data within an application. |
| 3 | +It is the process of verifying a user's identity to grant access to protected resources. It ensures only |
| 4 | +authenticated users can perform actions or access data within an application. |
5 | 5 |
|
6 | 6 | GoFr offer various approaches to implement authorization. |
7 | 7 |
|
@@ -66,12 +66,11 @@ func main() { |
66 | 66 | This code snippet demonstrates how to add basic authentication to an HTTP service in GoFr and make a request with the appropriate Authorization header: |
67 | 67 |
|
68 | 68 | ```go |
69 | | -app.AddHTTPService("cat-facts", "https://catfact.ninja", |
| 69 | +app.AddHTTPService("order", "https://localhost:2000", |
70 | 70 | &service.Authentication{UserName: "abc", Password: "pass"}, |
71 | 71 | ) |
72 | 72 | ``` |
73 | 73 |
|
74 | | - |
75 | 74 | ## 2. API Keys Auth |
76 | 75 | Users include a unique API key in the request header for validation against a store of authorized keys. |
77 | 76 |
|
@@ -126,3 +125,54 @@ This code snippet demonstrates how to add API Key authentication to an HTTP serv |
126 | 125 | ```go |
127 | 126 | app.AddHTTPService("http-server-using-redis", "http://localhost:8000", &service.APIKeyAuth{APIKey: "9221e451-451f-4cd6-a23d-2b2d3adea9cf"}) |
128 | 127 | ``` |
| 128 | + |
| 129 | +## 3. OAuth 2.0 |
| 130 | +OAuth 2.0 is the industry-standard protocol for authorization. |
| 131 | +It focuses on client developer simplicity while providing specific authorization flows for web applications, desktop applications, mobile phones, and living room devices. |
| 132 | +To know more about it refer [here](https://www.rfc-editor.org/rfc/rfc6749) |
| 133 | + |
| 134 | +It involves sending the term `Bearer` trailed by the encoded token within the standard `Authorization` header. |
| 135 | + |
| 136 | +### OAuth Authentication in GoFr |
| 137 | + |
| 138 | +GoFr supports authenticating tokens encoded by algorithm `RS256/384/512`. |
| 139 | + |
| 140 | +### App level Authentication |
| 141 | +Enable OAuth 2.0 with three-legged flow to authenticate requests |
| 142 | + |
| 143 | +Use `EnableOAuth(jwks-endpoint,refresh_interval)` to configure Gofr with pre-defined credentials. |
| 144 | + |
| 145 | +```go |
| 146 | +func main() { |
| 147 | + app := gofr.New() |
| 148 | + |
| 149 | + app.EnableOAuth("http://jwks-endpoint", 20) // Replace with your credentials |
| 150 | + |
| 151 | + app.GET("/protected-resource", func(c *gofr.Context) (interface{}, error) { |
| 152 | + // Handle protected resource access |
| 153 | + return nil, nil |
| 154 | + }) |
| 155 | + |
| 156 | + app.Run() |
| 157 | +} |
| 158 | +``` |
| 159 | + |
| 160 | +### Adding Basic Authentication to HTTP Services |
| 161 | +For server-to-server communication it follows two-legged OAuth, also known as "client credentials" flow, |
| 162 | +where the client application directly exchanges its own credentials (ClientID and ClientSecret) |
| 163 | +for an access token without involving any end-user interaction. |
| 164 | + |
| 165 | +This code snippet demonstrates how two-legged OAuth authentication is added to an HTTP service in GoFr and make a request with the appropriate Authorization header. |
| 166 | + |
| 167 | +```go |
| 168 | +a.AddHTTPService("orders", "http://localhost:9000", |
| 169 | + &service.OAuthConfig{ |
| 170 | + ClientID: "0iyeGcLYWudLGqZfD6HvOdZHZ5TlciAJ", |
| 171 | + ClientSecret: "GQXTY2f9186nUS3C9WWi7eJz8-iVEsxq7lKxdjfhOJbsEPPtEszL3AxFn8k_NAER", |
| 172 | + TokenURL: "https://dev-zq6tvaxf3v7p0g7j.us.auth0.com/oauth/token", |
| 173 | + Scopes: []string{"read:order"}, |
| 174 | + EndpointParams: map[string][]string{ |
| 175 | + "audience": {"https://dev-zq6tvaxf3v7p0g7j.us.auth0.com/api/v2/"}, |
| 176 | + }, |
| 177 | +}) |
| 178 | +``` |
0 commit comments