JWT and OAuth2 Implementations with Golang

8/22/2025

What is JSON Web Token?

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object (jwt.io).

This information can be verified and trusted because it is digitally signed.

JWTs can be signed using the following algorithms:

  • HMAC (secret)
  • RSA or ECDSA (public/private key pair)

JWTs can be encrypted to provide secrecy between parties

Signed vs encrypted tokens:

  • Signed tokens can verify the integrity of the claims contained within it
  • Encrypted tokens hide those claims from other parties

When tokens are signed using public/private key pairs, the signature also certifies that only the party holding the private key is the one that signed it.

When to use JWT?

  • Authorization:
    • The most common usage of JWT
    • Once the user is logged in, each subsequent request will include the JWT, allowing the user to access routes, services, and resources that are permitted with that token.
    • Single Sign On is a feature that widely uses JWT nowadays because of its small overhead and its ability to be easily used across different domains.
  • Information Exchange:
    • Because JWTs can be signed—for example, using public/private key pairs—you can be sure the senders are who they say they are
    • As the signature is calculated using the header and the payload, you can also verify that the content hasn't been tampered with.

JWT Structure

In its compact form, JSON Web Tokens consist of three parts separated by dots (.), which are:

  • Header
  • Payload
  • Signature

Therefore, a JWT typically looks like the following:

xxxxx.yyyyy.zzzzz

typically consists of two parts:

  • the type of the token, which is JWT
  • the signing algorithm being used, such as HMAC SHA256 or RSA.

Example:

{
  "alg": "HS256",
  "typ": "JWT"
}

Then, this JSON is Base64Url encoded to form the first part of the JWT.

Payload

Payload is the second part of the token, which contains claims.

Claims are statements about an entity (typically, the user) and additional data.

Three types of claims: registered, public and private

  • Registered claims:
    • a set of predefined claims which are not mandatory but recommended, to provide a set of useful, interoperable claims
    • Some of them are: iss (issuer), exp (expiration time), sub (subject), aud (audience), and others.
  • Public claims:
    • These can be defined at will by those using JWTs
    • However, to avoid collisions, they should be defined in the IANA JSON Web Token Registry or be defined as a URI that contains a collision-resistant namespace.
  • Private claims:
    • These are the custom claims created to share information between parties that agree on using them and are neither registered or public claims.

Example of payload:

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true
}

Resources

  • https://www.jwt.io/introduction
  • https://en.wikipedia.org/wiki/JSON_Web_Token
  • https://neurons.ruangguru.com/course/backend-development/web-application/authentication-and-authorization/json-web-token