第5章：微服务认证与安全

// 生成JWT
token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
	"iss": "myapp-key",
	"exp": time.Now().Add(1 * time.Hour).Unix(),
})
tokenString, _ := token.SignedString([]byte("my-secret-key"))

// 访问API
req, _ := http.NewRequest("GET", "http://localhost:8000/api/users", nil)
req.Header.Set("Authorization", "Bearer "+tokenString)
resp, _ := http.DefaultClient.Do(req)

// 所有服务使用相同密钥验证JWT
var jwtSecret = []byte("shared-secret-key")

func AuthMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		tokenString := extractToken(r)

		token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
			return jwtSecret, nil
		})

		if err != nil || !token.Valid {
			http.Error(w, "Unauthorized", 401)
			return
		}

		next.ServeHTTP(w, r)
	})
}

// 服务A调用服务B
type ServiceClient struct {
	serviceID     string
	serviceSecret string
	authURL       string
}

func (c *ServiceClient) GetAccessToken() (string, error) {
	// 用服务凭证获取Token
	resp, _ := http.PostForm(c.authURL+"/token", url.Values{
		"grant_type":    {"client_credentials"},
		"client_id":     {c.serviceID},
		"client_secret": {c.serviceSecret},
	})

	var result struct {
		AccessToken string `json:"access_token"`
	}
	json.NewDecoder(resp.Body).Decode(&result)

	return result.AccessToken, nil
}

func (c *ServiceClient) CallServiceB() error {
	// 获取Token
	token, _ := c.GetAccessToken()

	// 调用服务B
	req, _ := http.NewRequest("GET", "http://service-b/api/data", nil)
	req.Header.Set("Authorization", "Bearer "+token)
	resp, _ := http.DefaultClient.Do(req)

	return nil
}

// 服务A配置mTLS
func NewMTLSClient(certFile, keyFile, caFile string) (*http.Client, error) {
	// 加载客户端证书
	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
	if err != nil {
		return nil, err
	}

	// 加载CA证书
	caCert, _ := os.ReadFile(caFile)
	caCertPool := x509.NewCertPool()
	caCertPool.AppendCertsFromPEM(caCert)

	// 配置TLS
	tlsConfig := &tls.Config{
		Certificates: []tls.Certificate{cert},
		RootCAs:      caCertPool,
	}

	// 创建HTTP客户端
	return &http.Client{
		Transport: &http.Transport{
			TLSClientConfig: tlsConfig,
		},
	}, nil
}

// 使用
client, _ := NewMTLSClient("client.crt", "client.key", "ca.crt")
resp, _ := client.Get("https://service-b/api/data")

// 设置安全Header
func SecurityHeaders(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("X-Content-Type-Options", "nosniff")
		w.Header().Set("X-Frame-Options", "DENY")
		w.Header().Set("X-XSS-Protection", "1; mode=block")
		w.Header().Set("Content-Security-Policy", "default-src 'self'")
		next.ServeHTTP(w, r)
	})
}

// 转义用户输入
import "html"

func SafeOutput(input string) string {
	return html.EscapeString(input)
}

// CSRF Token生成
func GenerateCSRFToken() string {
	bytes := make([]byte, 32)
	rand.Read(bytes)
	return base64.URLEncoding.EncodeToString(bytes)
}

// CSRF中间件
func CSRFMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Method != "GET" {
			token := r.Header.Get("X-CSRF-Token")
			sessionToken := getSessionCSRFToken(r)

			if token != sessionToken {
				http.Error(w, "Invalid CSRF token", 403)
				return
			}
		}

		next.ServeHTTP(w, r)
	})
}

//  错误：拼接SQL
query := fmt.Sprintf("SELECT * FROM users WHERE username='%s'", username)
db.Query(query)

//  正确：使用参数化查询
db.Query("SELECT * FROM users WHERE username=?", username)

// 加密敏感字段
import "crypto/aes"
import "crypto/cipher"

func Encrypt(plaintext, key []byte) ([]byte, error) {
	block, _ := aes.NewCipher(key)
	gcm, _ := cipher.NewGCM(block)
	nonce := make([]byte, gcm.NonceSize())
	rand.Read(nonce)

	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
	return ciphertext, nil
}

func Decrypt(ciphertext, key []byte) ([]byte, error) {
	block, _ := aes.NewCipher(key)
	gcm, _ := cipher.NewGCM(block)

	nonceSize := gcm.NonceSize()
	nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]

	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
	return plaintext, err
}