Step 3 — Login and what a token is

1touch internal/user/token.go
2
3go build ./... && go run ./cmd/api
4
5# log in and keep the token
6TOKEN=$(curl -s -X POST localhost:8080/v1/auth/login \
7  -d '{"email":"a@b.c","password":"password123"}' | jq -r .access_token)
8echo $TOKEN
9
10# read your own claims — this is the lesson
11echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null; echo
12
13# wrong password, and an email that does not exist: identical answers
14curl -s -X POST localhost:8080/v1/auth/login -d '{"email":"a@b.c","password":"wrong"}'
15curl -s -X POST localhost:8080/v1/auth/login -d '{"email":"no@x.c","password":"wrong"}'
16
17# and similar timing
18time curl -s -o /dev/null -X POST localhost:8080/v1/auth/login -d '{"email":"a@b.c","password":"wrong"}'
19time curl -s -o /dev/null -X POST localhost:8080/v1/auth/login -d '{"email":"no@x.c","password":"wrong"}'

1eyJhbGciOiJIUzI1NiJ9  .  eyJzdWIiOiI0MiIsImV4cCI6MTc...  .  4pRXK9Bv2hZ...
2└──── header ────┘      └──────── payload ────────┘      └── signature ──┘
3  which algorithm            the claims: sub, exp          proof of the above

1func (s *Service) Login(ctx context.Context, email, password string) (string, error) {
2	u, err := s.repo.ByEmail(ctx, strings.ToLower(strings.TrimSpace(email)))
3	if err != nil {
4		// Hash anyway, so a missing account takes as long as a wrong password.
5		bcrypt.CompareHashAndPassword(dummyHash, []byte(password))
6		return "", ErrInvalidCredentials
7	}
8
9	// Hashes the attempt with the salt stored inside u.PasswordHash and compares
10	// in constant time. Nothing is ever unhashed.
11	if bcrypt.CompareHashAndPassword([]byte(u.PasswordHash), []byte(password)) != nil {
12		return "", ErrInvalidCredentials     // the SAME error as above
13	}
14
15	return s.issueToken(u.ID)
16}

1package user
2
3import (
4	"strconv"
5	"time"
6
7	"github.com/golang-jwt/jwt/v5"
8)
9
10func (s *Service) issueToken(userID int64) (string, error) {
11	claims := jwt.RegisteredClaims{
12		Subject:   strconv.FormatInt(userID, 10),   // "sub" — who this is about
13		IssuedAt:  jwt.NewNumericDate(time.Now()),
14		ExpiresAt: jwt.NewNumericDate(time.Now().Add(15 * time.Minute)),
15	}
16
17	return jwt.NewWithClaims(jwt.SigningMethodHS256, claims).SignedString(s.secret)
18}

1func (h *Handler) login(w http.ResponseWriter, r *http.Request) {
2	var in struct {
3		Email    string `json:"email"`
4		Password string `json:"password"`
5	}
6
7	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20)).Decode(&in); err != nil {
8		httpx.Error(w, 400, "invalid json")
9		return
10	}
11
12	token, err := h.svc.Login(r.Context(), in.Email, in.Password)
13	if err != nil {
14		httpx.Error(w, 401, "invalid credentials")   // never say which part was wrong
15		return
16	}
17
18	httpx.JSON(w, 200, map[string]any{
19		"access_token": token,
20		"token_type":   "Bearer",
21		"expires_in":   900,              // seconds, so the client knows when to refresh
22	})
23}

1TOKEN=$(curl -s -X POST localhost:8080/v1/auth/login \
2  -d '{"email":"a@b.c","password":"password123"}' | jq -r .access_token)
3
4# Decode the middle chunk yourself
5echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null
6# {"sub":"1","iat":1757...,"exp":1757...}
7
8# Wrong password, and an email that does not exist — identical responses
9curl -s -X POST localhost:8080/v1/auth/login -d '{"email":"a@b.c","password":"wrong"}'
10curl -s -X POST localhost:8080/v1/auth/login -d '{"email":"nope@x.c","password":"wrong"}'