tecnickcom / gogen / 28934407441

100%

push

github

feat(jwt)!: self-contained HMAC engine, verifier-based API, and security hardening

Rework the jwt package into a hardened, net/http-oriented JWT auth helper. Tokens are now signed and verified by a standard-library-only HMAC-SHA2 (HS256/HS384/HS512) implementation of the RFC 7515/7519 compact JWS, removing the github.com/golang-jwt/jwt/v5 build dependency (retained test-only for cross-validation). Restricting the surface to symmetric HMAC and verifying the signature before decoding the claims payload makes alg=none and algorithm-confusion attacks structurally impossible.

BREAKING CHANGES:
- New takes VerifyCredentialsFn func(username, password string) (bool, error) instead of UserHashFn: credential verification is fully delegated, so the package is agnostic to the password-hashing scheme (pair it with pkg/passwordhash) and no longer performs bcrypt comparison itself.
- SigningMethod is now an HS256/HS384/HS512 enum instead of an alias of the upstream interface, and Claims carries native fields instead of embedding jwt.RegisteredClaims.
- WithClaimSubject is removed; the sub claim is now set to the authenticated username.

Security hardening:
- Pin the accepted signing algorithm and require exp, enforcing it exclusively per RFC 7519 §4.1.4; validate nbf with optional clock-skew leeway; enforce iss and the full aud set when configured.
- Cap the login request body (413 on overflow) and reject unknown or trailing JSON; return generic client messages while logging details server-side; distinguish invalid credentials (401) from credential-backend failures (500).
- Bound how long a session can be kept alive by renewals via an auth_time claim preserved across renewals and a configurable maximum lifetime, so a stolen token cannot be renewed indefinitely.
- Support HMAC key rotation through previous keys accepted for verification, validate minimum key length against the method hash size, and copy caller-supplied key material so later mutation cannot affect t... (continued)

418 of 418 new or added lines in 5 files covered. (100.0%)

14897 of 14899 relevant lines covered (99.99%)

996.0 hits per line