This lesson's interactive features are locked, please to keep using them

JWTs

There are several different ways to handle authentication. We'll use JWTs in this course. They're a popular choice for APIs that are consumed by web applications and mobile apps.

What Is a JWT?

A JWT is a JSON Web Token. It's a cryptographically signed JSON object that contains information about the user. You'll learn about how the cryptography of JWTs work in our Learn Cryptography course, for now, it's just important to know that once the token is created by the server, the data in the token can't be changed without the server knowing.

When your server issues a JWT to Bob, Bob can use that token to make requests as Bob to your API. Bob won't be able to change the token to make requests as Alice.

Assignment

The first building blocks you'll write are the functions for creating and validating JWTs, which will be used in the next lesson to authenticate users.

Add a MakeJWT function to your auth package:
```
func MakeJWT(userID uuid.UUID, tokenSecret string, expiresIn time.Duration) (string, error)
```
Create and return a JWT using this JWT library, which you can import into your code by running:
```
go get -u github.com/golang-jwt/jwt/v5
```
Create a new token.
1. Use jwt.NewWithClaims
2. Use jwt.SigningMethodHS256 as the signing method.
3. Use jwt.RegisteredClaims as the claims.
  - Set the Issuer to "chirpy-access"
  - Set IssuedAt to the current time in UTC
  - Set ExpiresAt to the current time plus the expiration time (expiresIn)
  - Set the Subject to a stringified version of the user's id
4. Use token.SignedString to sign the token with the secret key. Refer to the docs for an overview of the different signing methods and their respective key types.

Add a ValidateJWT function to your auth package:

func ValidateJWT(tokenString, tokenSecret string) (uuid.UUID, error)

Use the jwt.ParseWithClaims function to validate the signature of the JWT and extract the claims into a *jwt.Token struct. The keyFunc callback must return the same key type ([]byte) used when the token was signed. An error will be returned if the token is invalid or has expired.

If all is well with the token, use the token.Claims interface to get access to the user's id from the claims (which should be stored in the Subject field). Return the id as a uuid.UUID.
Add some more unit tests to the auth package. Make sure that you can create and validate JWTs, and that expired tokens are rejected and JWTs signed with the wrong secret are rejected.

Run and submit the CLI tests.