JWT 认证与 Kubernetes 部署

# docker-compose.yaml
services:
  redis:
    image: redis:7
    ports:
      - "6379:6379"
    environment:
      # 测试环境允许空密码，生产必须设密码
      ALLOW_EMPTY_PASSWORD: "yes"

docker compose up -d

package web

import (
    "github.com/gin-contrib/sessions"
    "github.com/gin-contrib/sessions/redis"
)

func InitSessionStore() sessions.Store {
    // 步骤 1：两个 key：
    //   Authentication：身份认证（防篡改）
    //   Encryption：数据加密（防泄露）
    // size=32 表示用 32 字节长度的 key
    // 步骤 2：连接本地 Redis（测试环境无密码，传空串）
    store, err := redis.NewStore(16, "tcp",
        "localhost:6379", "",
        []byte("authentication-key-must-be-32-bytes!"),
        []byte("encryption-key-must-be-32-bytes!!"),
    )
    if err != nil {
        panic(err)
    }
    return store
}

package web

import (
    "time"

    "github.com/gin-contrib/sessions"
    "github.com/gin-gonic/gin"
)

// LoginRequired 登录校验 + 过期刷新
func (h *UserHandler) LoginRequired(c *gin.Context) {
    // 步骤 1：取出 user_id，拿不到说明没登录
    sess := sessions.Default(c)
    userID, ok := sess.Get("user_id").(int64)
    if !ok || userID == 0 {
        c.AbortWithStatus(http.StatusUnauthorized)
        return
    }

    // 步骤 2：固定间隔刷新——1 分钟内只刷新一次
    // 用 sess_id 的最后刷新时间判断
    now := time.Now().UnixMilli()
    lastRefresh, _ := sess.Get("last_refresh").(int64)
    if now-lastRefresh > 60*time.Second.Milliseconds() {
        // 步骤 3：更新刷新时间 + 重设过期时间 + 落盘
        sess.Set("last_refresh", now)
        sess.Options(sessions.Options{MaxAge: 60 * 60 * 24})
        // 刷新 Redis 中的 Session 过期时间
        _ = sess.Save()
    }

    // 步骤 4：把 user_id 注入 context，供后续 handler 使用
    c.Set("user_id", userID)
    c.Next()
}

{
  "alg": "HS256",   // 签名算法
  "typ": "JWT"       // 类型
}

{
  "user_id": 123,
  "user_agent": "Mozilla/...",
  "exp": 1699999999,    // 过期时间
  "iat": 1690000000,    // 签发时间
  "nbf": 1690000000     // 生效时间
}

go get github.com/golang-jwt/jwt/v5

package web

import (
    "errors"
    "net/http"
    "strings"
    "time"

    "github.com/gin-gonic/gin"
    "github.com/golang-jwt/jwt/v5"
)

// UserClaims JWT 中携带的数据
type UserClaims struct {
    UserID    int64  `json:"user_id"`
    UserAgent string `json:"user_agent"` // 用于增强安全
    jwt.RegisteredClaims                  // 嵌入标准声明（exp, iat, nbf...）
}

type UserHandler struct {
    svc         *service.UserService
    jwtSecret   []byte // JWT 签名密钥，必须保密
}

func NewUserHandler(svc *service.UserService) *UserHandler {
    return &UserHandler{
        svc:       svc,
        jwtSecret: []byte("my-jwt-secret-key-keep-it-safe"),
    }
}

// Login 用 JWT 改造的登录接口
func (h *UserHandler) Login(c *gin.Context) {
    // 步骤 1：绑定请求体
    var req struct {
        Email    string `json:"email"`
        Password string `json:"password"`
    }
    if err := c.Bind(&req); err != nil {
        return
    }
    // 步骤 2：校验账号密码
    user, err := h.svc.Login(req.Email, req.Password)
    if err != nil {
        c.JSON(http.StatusOK, gin.H{"msg": "用户名或密码不对"})
        return
    }

    // 步骤 3：填充 Claims（user_id + User-Agent + 过期/签发时间）
    claims := UserClaims{
        UserID:    user.ID,
        UserAgent: c.GetHeader("User-Agent"),
        RegisteredClaims: jwt.RegisteredClaims{
            ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour * 24)),
            IssuedAt:  jwt.NewNumericDate(time.Now()),
        },
    }
    // 步骤 4：用 HS256 + secret 签发 token
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
    tokenStr, err := token.SignedString(h.jwtSecret)
    if err != nil {
        c.JSON(http.StatusOK, gin.H{"msg": "系统错误"})
        return
    }

    // 步骤 5：通过响应头 x-jwt-token 返回，前端存好后续带上
    c.Header("x-jwt-token", tokenStr)
    c.JSON(http.StatusOK, gin.H{"msg": "登录成功"})
}

package web

import (
    "net/http"
    "strings"
    "time"

    "github.com/gin-gonic/gin"
    "github.com/golang-jwt/jwt/v5"
)

func (h *UserHandler) LoginRequiredJWT(c *gin.Context) {
    // 步骤 1：从 Authorization 头部读取
    authHeader := c.GetHeader("Authorization")
    if authHeader == "" {
        c.AbortWithStatus(http.StatusUnauthorized)
        return
    }
    // 步骤 2：按 "Bearer xxxxxx" 格式拆分
    parts := strings.SplitN(authHeader, " ", 2)
    if len(parts) != 2 || parts[0] != "Bearer" {
        c.AbortWithStatus(http.StatusUnauthorized)
        return
    }
    tokenStr := parts[1]

    // 步骤 3：解析 + 验证签名
    claims := &UserClaims{}
    token, err := jwt.ParseWithClaims(tokenStr, claims, func(t *jwt.Token) (any, error) {
        // 这里返回用于验签的密钥
        return h.jwtSecret, nil
    })
    if err != nil || !token.Valid {
        c.AbortWithStatus(http.StatusUnauthorized)
        return
    }

    // 步骤 4：增强安全——校验 User-Agent 是否和登录时一致
    // 防止 token 被盗后在不同设备使用
    if claims.UserAgent != c.GetHeader("User-Agent") {
        c.AbortWithStatus(http.StatusUnauthorized)
        return
    }

    // 步骤 5：固定间隔刷新 token（把新 token 放响应头）
    // JWT 不能像 Session 那样在服务端刷新，只能重新签发
    if claims.ExpiresAt != nil &&
        claims.ExpiresAt.Sub(time.Now()) < time.Hour {
        newClaims := UserClaims{
            UserID:    claims.UserID,
            UserAgent: claims.UserAgent,
            RegisteredClaims: jwt.RegisteredClaims{
                ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour * 24)),
                IssuedAt:  jwt.NewNumericDate(time.Now()),
            },
        }
        newToken := jwt.NewWithClaims(jwt.SigningMethodHS256, newClaims)
        if newTokenStr, err := newToken.SignedString(h.jwtSecret); err == nil {
            c.Header("x-jwt-token", newTokenStr)
        }
    }

    // 步骤 6：注入 context，放行
    c.Set("user_id", claims.UserID)
    c.Next()
}

engine.Use(cors.New(cors.Config{
    AllowOriginFunc: func(origin string) bool {
        return origin == "http://localhost:3000"
    },
    AllowCredentials: true,
    // 业务请求允许带的头：加上 Authorization
    AllowHeaders: []string{"Content-Type", "Authorization"},
    // 允许前端读到的响应头：加上 x-jwt-token
    ExposeHeaders: []string{"x-jwt-token"},
    AllowMethods:  []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
    MaxAge:        12 * time.Hour,
}))

package middleware

import (
    "fmt"
    "net/http"
    "time"

    "github.com/gin-gonic/gin"
    "github.com/redis/go-redis/v9"
)

// IPMaxReqPerSec 每秒每 IP 最大请求数
const IPMaxReqPerSec = 100

func IPRateLimit(client *redis.Client) gin.HandlerFunc {
    return func(c *gin.Context) {
        // 步骤 1：拼 key，精确到"秒 + IP"
        ip := c.ClientIP()
        key := fmt.Sprintf("ip:rate:%s:%d", ip, time.Now().Unix())

        // 步骤 2：INCR 原子递增，第一次 INCR 时 key 不存在会创建并设为 1
        cnt, err := client.Incr(c, key).Result()
        if err != nil {
            // 步骤 3：Redis 出错时降级：放行（避免 Redis 故障导致服务不可用）
            c.Next()
            return
        }
        // 步骤 4：第一次访问时设置过期时间，让 key 在下一秒自动清理
        if cnt == 1 {
            client.Expire(c, key, time.Second)
        }
        // 步骤 5：超阈值则拦截
        if cnt > IPMaxReqPerSec {
            c.AbortWithStatusJSON(http.StatusTooManyRequests,
                gin.H{"msg": "请求过于频繁"})
            return
        }
        c.Next()
    }
}

// 登录时把 User-Agent 写进 JWT（见 3.5）
// 登录校验时比对（见 3.6）
if claims.UserAgent != c.GetHeader("User-Agent") {
    c.AbortWithStatus(http.StatusUnauthorized)
    return
}

# Mac Apple Silicon 用 arm64，Linux 服务器看具体架构
# 大部分云服务器是 amd64
GOOS=linux GOARCH=amd64 go build -o webook .

FROM ubuntu:22.04
# 拷贝可执行文件
COPY webook /app/webook
WORKDIR /app
# 暴露端口（仅声明，实际端口映射由 K8s 控制）
EXPOSE 8080
# 启动命令
ENTRYPOINT ["/app/webook"]

docker build -t flycash/webook:v0.0.1 .

docker:
    GOOS=linux GOARCH=amd64 go build -o webook .
    docker build -t flycash/webook:v0.0.1 .

# k8s-webook-deployment.yaml
apiVersion: apps/v1    # K8s 用 apiVersion 决定如何解读配置
kind: Deployment       # 资源类型
metadata:
  name: webook         # Deployment 名字
  labels:
    app: webook
spec:
  replicas: 3          # 副本数：3 个 Pod
  selector:
    # 筛选器：Deployment 怎么找到它管理的 Pod
    # 通过标签匹配：含 app=webook 标签的 Pod 都归我管
    matchLabels:
      app: webook
  template:            # Pod 模板：照着这个创建 Pod
    metadata:
      labels:
        app: webook    # Pod 的标签，必须和 selector 对得上
    spec:
      containers:
        - name: webook
          image: flycash/webook:v0.0.1
          ports:
            - containerPort: 8080   # Pod 内部端口

# k8s-webook-service.yaml
apiVersion: v1
kind: Service
metadata:
  name: webook
spec:
  type: LoadBalancer    # 负载均衡类型，外部可访问
  selector:
    app: webook         # 把流量转发到含 app=webook 标签的 Pod
  ports:
    - name: http
      port: 8080          # Service 对外端口
      protocol: TCP
      targetPort: 8080    # 转发到 Pod 的哪个端口

kubectl apply -f k8s-webook-deployment.yaml
kubectl apply -f k8s-webook-service.yaml

kubectl get pods         # 查看 Pod
kubectl get deployments  # 查看 Deployment
kubectl get services     # 查看 Service
kubectl logs <pod-name>  # 查看 Pod 日志
kubectl describe pod <pod-name>  # 排查问题

# k8s-mysql.yaml
---
# 持久化卷声明
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mysql
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
        - name: mysql
          image: mysql:8.0.29
          env:
            - name: MYSQL_ROOT_PASSWORD
              value: root
          ports:
            - containerPort: 3306
          volumeMounts:
            # 挂载到容器的 /var/lib/mysql
            - name: mysql-storage
              mountPath: /var/lib/mysql
      volumes:
        - name: mysql-storage
          persistentVolumeClaim:
            claimName: mysql-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: mysql
spec:
  selector:
    app: mysql
  ports:
    - port: 3306
      targetPort: 3306

# k8s-redis.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
        - name: redis
          image: redis:7
          ports:
            - containerPort: 6379
---
apiVersion: v1
kind: Service
metadata:
  name: redis
spec:
  type: NodePort       # 暴露到集群外
  selector:
    app: redis
  ports:
    - port: 6379          # 集群内访问：redis:6379
      targetPort: 6379    # 转发到 Pod
      nodePort: 31379     # 集群外访问：localhost:31379

kubectl apply -f k8s-redis.yaml
redis-cli -p 31379 ping  # 应返回 PONG

# 安装 helm
curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.sh

# 用 helm 安装 ingress-nginx
helm upgrade --install ingress-nginx ingress-nginx \
  --repo https://kubernetes.github.io/ingress-nginx \
  --namespace ingress-nginx --create-namespace

# k8s-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webook-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx    # 指定用 nginx 这个 Ingress Controller
  rules:
    - host: webook.local       # 域名
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: webook    # 转发到 webook Service
                port:
                  number: 8080

kubectl apply -f k8s-ingress.yaml

// internal/config/config.go
package config

type Config struct {
    DBDSN   string
    RedisAddr string
}

var Cfg Config

// internal/config/dev.go
//go:build !k8s
package config

func init() {
    Cfg = Config{
        DBDSN:     "root:root@tcp(localhost:3306)/webook",
        RedisAddr: "localhost:6379",
    }
}

// internal/config/k8s.go
//go:build k8s
package config

func init() {
    Cfg = Config{
        // 在 K8s 里用 Service 名 + 端口访问
        DBDSN:     "root:root@tcp(mysql:3306)/webook",
        RedisAddr: "redis:6379",
    }
}

# 普通开发
go build -o webook .

# K8s 部署
go build -tags=k8s -o webook .

kubectl apply -f k8s-mysql.yaml
kubectl apply -f k8s-redis.yaml
kubectl apply -f k8s-webook-deployment.yaml
kubectl apply -f k8s-webook-service.yaml
kubectl apply -f k8s-ingress.yaml

# 查看启动状态
kubectl get pods
kubectl logs -f <webook-pod-name>