GAE Go 应用中实现 OAuth2 用户登录认证指南

package main  import (     "context"     "crypto/rand"     "encoding/base64"     "encoding/JSon"     "fmt"     "io/ioutil"     "log"     "net/http"     "time"      "golang.org/x/oauth2"     "golang.org/x/oauth2/google" // 导入 Google OAuth2 端点 )

// googleOauthConfig 存储 OAuth2 配置 var googleOauthConfig *oauth2.Config  // init 函数在包被导入时执行，用于初始化配置 func init() {     // 替换为您的实际 Client ID 和 Client Secret     // 建议从环境变量或安全配置服务中读取这些敏感信息     googleOauthConfig = &oauth2.Config{         RedirectURL:  "http://localhost:8080/oauth2callback", // 本地测试地址，部署到 GAE 后需改为实际地址         ClientID:     "YOUR_CLIENT_ID.apps.googleusercontent.com",         ClientSecret: "YOUR_CLIENT_SECRET",         // 定义请求的权限范围。userinfo.profile 和 userinfo.email 是获取用户基本信息的常用范围。         Scopes:       []string{"https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email"},         Endpoint:     google.Endpoint, // 使用 Google 的 OAuth2 端点     }      // 注册 HTTP 路由处理器     http.HandleFunc("/", handleHome)     http.HandleFunc("/login", handleGoogleLogin)     http.HandleFunc("/oauth2callback", handleGoogleCallback)     http.HandleFunc("/logout", handleLogout) }

Article Forge

行业文案AI写作软件，可自动为特定主题或行业生成内容

22

查看详情

// generateRandomState 生成一个随机字符串作为 state 参数 func generateRandomState() (string, error) {     b := make([]byte, 16)     _, err := rand.Read(b)     if err != nil {         return "", err     }     return base64.URLEncoding.EncodeToString(b), nil }  // handleGoogleLogin 处理用户点击登录的请求 func handleGoogleLogin(w http.ResponseWriter, r *http.Request) {     state, err := generateRandomState()     if err != nil {         http.Error(w, "Failed to generate state", http.StatusInternalServerError)         return     }      // 将 state 存储在 Cookie 中，以便在回调时验证     // 在生产环境中，应考虑使用更安全的会话管理方式，例如存储在服务器端会话中     http.SetCookie(w, &http.Cookie{         Name:    "oauthstate",         Value:   state,         Path:    "/",         Expires: time.Now().Add(5 * time.Minute), // 设置过期时间         // Secure:   true, // 生产环境请开启 HTTPS 并设置为 true         // HttpOnly: true, // 防止 XSS 攻击         SameSite: http.SameSiteLaxMode, // 增加安全性     })      // 生成授权 URL 并重定向用户     // "offline_access" scope 可以用于获取 refresh token，以便在 access token 过期后重新获取     url := googleOauthConfig.AuthCodeURL(state, oauth2.AccessTypeOffline)     http.Redirect(w, r, url, http.StatusTemporaryRedirect) }

// handleGoogleCallback 处理 Google OAuth2 回调请求 func handleGoogleCallback(w http.ResponseWriter, r *http.Request) {     // 1. 验证 state 参数     cookieState, err := r.Cookie("oauthstate")     if err != nil || r.FormValue("state") != cookieState.Value {         log.Printf("Invalid state parameter: %v, cookie: %v", r.FormValue("state"), cookieState)         http.Error(w, "Invalid state parameter", http.StatusUnauthorized)         return     }     // 清除 state cookie     http.SetCookie(w, &http.Cookie{         Name:    "oauthstate",         Value:   "",         Path:    "/",         Expires: time.Unix(0, 0), // 立即过期     })      // 2. 交换授权码为令牌     code := r.FormValue("code")     if code == "" {         http.Error(w, "Authorization code not provided", http.StatusBadRequest)         return     }      token, err := googleOauthConfig.Exchange(context.Background(), code)     if err != nil {         log.Printf("Failed to exchange code for token: %v", err)         http.Error(w, "Failed to exchange code for token", http.StatusInternalServerError)         return     }      // 3. 使用访问令牌获取用户资料     client := googleOauthConfig.Client(context.Background(), token)     resp, err := client.Get("https://www.googleapis.com/oauth2/v3/userinfo")     if err != nil {         log.Printf("Failed to get user info: %v", err)         http.Error(w, "Failed to get user info", http.StatusInternalServerError)         return     }     defer resp.Body.Close()      userInfoBytes, err := ioutil.ReadAll(resp.Body)     if err != nil {         log.Printf("Failed to read user info response: %v", err)         http.Error(w, "Failed to read user info response", http.StatusInternalServerError)         return     }      // 解析用户信息     var userInfo map[string]interface{}     if err := json.Unmarshal(userInfoBytes, &userInfo); err != nil {         log.Printf("Failed to parse user info: %v", err)         http.Error(w, "Failed to parse user info", http.StatusInternalServerError)         return     }      // 4. 处理用户登录成功     // 在此处，您可以根据 userInfo 中的 "sub" (Google 用户ID)、"email"、"name" 等信息，     // 在您的应用程序数据库中查找或创建用户记录，并建立用户会话。     // 示例：将用户信息存储在会话 Cookie 中 (生产环境应加密或使用服务器端会话)     userJSON, _ := json.Marshal(userInfo)     http.SetCookie(w, &http.Cookie{         Name:    "user_Session",         Value:   base64.URLEncoding.EncodeToString(userJSON),         Path:    "/",         Expires: time.Now().Add(24 * time.Hour), // 会话有效期         // Secure:   true,         // HttpOnly: true,         SameSite: http.SameSiteLaxMode,     })      log.Printf("User logged in: %s (%s)", userInfo["name"], userInfo["email"])     http.Redirect(w, r, "/", http.StatusFound) // 重定向到主页 }

 package main  import (     "context"     "crypto/rand"     "encoding/base64"     "encoding/json"     "fmt"     "io/ioutil"     "log"     "net/http"     "os"     "time"      "golang.org/x/oauth2"     "golang.org/x/oauth2/google" )  // googleOauthConfig 存储 OAuth2 配置 var googleOauthConfig *oauth2.Config  func init() {     // 从环境变量中读取 Client ID 和 Client Secret     // 这是 GAE 部署的推荐方式，避免硬编码敏感信息     clientID := os.Getenv("GOOGLE_CLIENT_ID")     clientSecret := os.Getenv("GOOGLE_CLIENT_SECRET")     redirectURL := os.Getenv("GOOGLE_REDIRECT_URL") // 例如: https://YOUR_APP_ID.appspot.com/oauth2callback      if clientID == "" || clientSecret == "" || redirectURL == "" {         log.Fatal("Missing GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, or GOOGLE_REDIRECT_URL environment variables")     }      googleOauthConfig = &oauth2.Config{         RedirectURL:  redirectURL,         ClientID:     clientID,         ClientSecret: clientSecret,         Scopes:       []string{"https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email"},         Endpoint:     google.Endpoint,     }      // 注册 HTTP 路由处理器     http.HandleFunc("/", handleHome)     http.HandleFunc("/login", handleGoogleLogin)     http.HandleFunc("/oauth2callback", handleGoogleCallback)     http.HandleFunc("/logout", handleLogout) }  func main() {     // GAE 标准环境会自动监听 8080 端口     // 在本地运行，可以显式启动服务器     port := os.Getenv("PORT")     if port == "" {         port = "8080"     }     log.Printf("Listening on port %s", port)     if err := http.ListenAndServe(":"+port, nil); err != nil {         log.Fatalf("Server failed to start: %v", err)     } }  // generateRandomState 生成一个随机字符串作为 state 参数 func generateRandomState() (string, error) {     b := make([]byte, 16)     _, err := rand.Read(b)     if err != nil {         return "", err     }     return base64.URLEncoding.EncodeToString(b), nil }  // getUserInfoFromSession 从会话 Cookie 中获取用户信息 func getUserInfoFromSession(r *http.Request) (map[string]interface{}, error) {     cookie, err := r.Cookie("user_session")     if err != nil {         return nil, fmt.Errorf("no user session cookie found: %w", err)     }      decoded, err := base64.URLEncoding.DecodeString(cookie.Value)     if err != nil {         return nil, fmt.Errorf("failed to decode user session: %w", err)     }      var userInfo map[string]interface{}     if err := json.Unmarshal(decoded, &userInfo); err != nil {         return nil, fmt.Errorf("failed to unmarshal user info: %w", err)     }     return userInfo, nil }  // handleHome 应用程序主页 func handleHome(w http.ResponseWriter, r

大家都在看：