fix(Security) using golang-jwt instead of jwt-go (#125)

ASM-Studios · Dec 5, 2024 · e749213 · e749213
1 parent 29fca04
commit e749213
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 7 deletions.
diff --git a/server/go.mod b/server/go.mod
@@ -1,7 +1,6 @@
 module AREA
 
 require (
-	github.com/dgrijalva/jwt-go v3.2.0+incompatible
 	github.com/gin-contrib/cors v1.7.2
 	github.com/gin-gonic/gin v1.10.0
 	github.com/gookit/config/v2 v2.2.5
@@ -30,6 +29,7 @@ require (
 	github.com/go-playground/validator/v10 v10.23.0 // indirect
 	github.com/go-sql-driver/mysql v1.7.0 // indirect
 	github.com/goccy/go-json v0.10.3 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/gookit/color v1.5.4 // indirect
 	github.com/gookit/goutil v0.6.17 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect

diff --git a/server/go.sum b/server/go.sum
@@ -54,6 +54,8 @@ github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PU
 github.com/goccy/go-yaml v1.11.2 h1:joq77SxuyIs9zzxEjgyLBugMQ9NEgTWxXfz2wVqwAaQ=
 github.com/goccy/go-yaml v1.11.2/go.mod h1:wKnAMd44+9JAAnGQpWVEgBzGt3YuTaQ4uXoHvE4m7WU=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
+github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=

diff --git a/server/internal/utils/token.go b/server/internal/utils/token.go
@@ -2,11 +2,11 @@ package utils
 
 import (
 	"errors"
-	"github.com/dgrijalva/jwt-go"
 	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
 	"net/http"
-	"time"
 	"strings"
+	"time"
 )
 
 func NewToken(c *gin.Context, email string) string {
@@ -24,11 +24,11 @@ func NewToken(c *gin.Context, email string) string {
 func VerifyToken(c *gin.Context) (string, error) {
 	authHeader := c.GetHeader("Authorization")
 
-    if !strings.HasPrefix(authHeader, "Bearer ") {
-        return "", errors.New("Bearer token is missing")
-    }
+	if !strings.HasPrefix(authHeader, "Bearer ") {
+		return "", errors.New("Bearer token is missing")
+	}
 
-    tokenString := strings.TrimPrefix(authHeader, "Bearer ")
+	tokenString := strings.TrimPrefix(authHeader, "Bearer ")
 
 	if tokenString == "" {
 		return "", errors.New("Authorization token is missing")