$ show golang-jwt/jwt
This is the official Go implementation of JSON Web Tokens (JWT), currently at v5. It provides a comprehensive library for creating, signing, parsing, and validating JWTs. The core package implements all standard JWT claims (RegisteredClaims and MapClaims), multiple signing algorithms (HMAC-SHA, RSA, RSA-PSS, ECDSA, Ed25519), and a flexible parser with functional options for configuration (e.g., allowed algorithms, leeway, audience/issuer/subject validation). The library also includes a `request` subpackage for extracting tokens from HTTP requests via headers or form/query parameters, and a `cmd/jwt` CLI tool for debugging and batch operations. Architecturally, it follows a clean separation of concerns: signing methods implement a common `SigningMethod` interface, claims implement a getter-based `Claims` interface, and validation is handled by a stand-alone `Validator` struct that can be used independently of parsing. The code is well-tested, uses only the Go standard library (no third-party dependencies), and follows modern Go idioms like functional options and error wrapping (Go 1.20+). It is actively maintained with CI, linting, CodeQL, and spell-check workflows.
The LLM identified 3 files worth highlighting for reuse:
Defines `NumericDate` and `ClaimStrings` types with custom JSON marshal/unmarshal methods. `NumericDate` handles RFC 7519 numeric timestamps with configurable precision (`TimePrecision`) and edge cases like very large timestamps via string concatenation. `ClaimStrings` supports unmarshaling from both a single string and an array of strings (per RFC), with a configurable `MarshalSingleStringAsArray` variable. These types are self-contained, depend only on the standard library, and can be extracted and reused in any project requiring JSON numeric dates or flexible string arrays.
Implements structured error aggregation using `joinErrors` and `newError` functions. `joinErrors` creates a `joinedError` that behaves like `errors.Join` but formats errors with comma separation instead of newlines. `newError` constructs a chained error message using multiple `%w` directives (Go 1.20+), allowing rich error context (e.g., wrapping `ErrTokenExpired` with 'by 5m0s'). Both functions are isolated, depend only on standard library, and demonstrate a reusable pattern for building composable error chains.
Defines the `Extractor` interface and several composable implementations for extracting tokens from HTTP requests. Includes `HeaderExtractor`, `ArgumentExtractor`, `MultiExtractor` (tries multiple extractors in order), `PostExtractionFilter` (applies a filter function after extraction), and a concrete `BearerExtractor`. This pattern is decoupled from JWT specifics and could be reused in any Go service that needs to extract bearer tokens or other HTTP header/form values. The extractors handle edge cases like case-insensitive 'Bearer' prefix and form parsing errors gracefully.