github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 22:32:01 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

how to decode signed cookie with a secret. #1063

New Issue
Closed
opened 2026-03-13 08:20:56 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-13 08:20:56 -05:00
Owner
Copy Link

Originally created by @kaleb110 on GitHub (Apr 16, 2025).

how to extract a cookie value in my go server?

package middleware

import (
	"context"
	"log"
	"net/http"
	"net/url"
	"os"

	"github.com/golang-jwt/jwt/v5"
)

type contextKey string

const userIDContextKey contextKey = "user_id"

func AuthMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// 1. Get the cookie
		cookie, err := r.Cookie("custom_cookie") 
		if err != nil {
			log.Printf("Cookie error: %v", err)
			http.Error(w, "Unauthorized", http.StatusUnauthorized)
			return
		}

		// 2. URL-decode the value (since it contains %2B, %3D, etc.)
		decodedValue, err := url.QueryUnescape(cookie.Value)
		if err != nil {
			log.Printf("URL decode error: %v", err)
			http.Error(w, "Invalid cookie", http.StatusBadRequest)
			return
		}

		log.Print("log", decodedValue)
		// 3. Parse the JWT
		token, err := jwt.Parse(decodedValue, func(token *jwt.Token) (interface{}, error) {
			return []byte(os.Getenv("BETTER_AUTH_SECRET")), nil 
		})
		if err != nil {
			log.Printf("JWT parse error: %v", err)
			http.Error(w, "Invalid token", http.StatusUnauthorized)
			return
		}

		// 4. Extract claims
		claims, ok := token.Claims.(jwt.MapClaims)
		if !ok || !token.Valid {
			log.Printf("Invalid JWT claims")
			http.Error(w, "Unauthorized", http.StatusUnauthorized)
			return
		}

		// 5. Get user_id (adjust claim key as needed)
		userID, ok := claims["id"].(string)
		if !ok {
			log.Printf("user_id not found in claims: %+v", claims)
			http.Error(w, "Unauthorized", http.StatusUnauthorized)
			return
		}

		// 6. Attach to context and proceed
		ctx := context.WithValue(r.Context(), userIDContextKey, userID)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

func GetUserIDFromContext(ctx context.Context) (string, bool) {
	userID, ok := ctx.Value(userIDContextKey).(string)
	return userID, ok
}
Originally created by @kaleb110 on GitHub (Apr 16, 2025). how to extract a cookie value in my go server? ``` package middleware import ( "context" "log" "net/http" "net/url" "os" "github.com/golang-jwt/jwt/v5" ) type contextKey string const userIDContextKey contextKey = "user_id" func AuthMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { // 1. Get the cookie cookie, err := r.Cookie("custom_cookie") if err != nil { log.Printf("Cookie error: %v", err) http.Error(w, "Unauthorized", http.StatusUnauthorized) return } // 2. URL-decode the value (since it contains %2B, %3D, etc.) decodedValue, err := url.QueryUnescape(cookie.Value) if err != nil { log.Printf("URL decode error: %v", err) http.Error(w, "Invalid cookie", http.StatusBadRequest) return } log.Print("log", decodedValue) // 3. Parse the JWT token, err := jwt.Parse(decodedValue, func(token *jwt.Token) (interface{}, error) { return []byte(os.Getenv("BETTER_AUTH_SECRET")), nil }) if err != nil { log.Printf("JWT parse error: %v", err) http.Error(w, "Invalid token", http.StatusUnauthorized) return } // 4. Extract claims claims, ok := token.Claims.(jwt.MapClaims) if !ok || !token.Valid { log.Printf("Invalid JWT claims") http.Error(w, "Unauthorized", http.StatusUnauthorized) return } // 5. Get user_id (adjust claim key as needed) userID, ok := claims["id"].(string) if !ok { log.Printf("user_id not found in claims: %+v", claims) http.Error(w, "Unauthorized", http.StatusUnauthorized) return } // 6. Attach to context and proceed ctx := context.WithValue(r.Context(), userIDContextKey, userID) next.ServeHTTP(w, r.WithContext(ctx)) }) } func GetUserIDFromContext(ctx context.Context) (string, bool) { userID, ok := ctx.Value(userIDContextKey).(string) return userID, ok } ```
GiteaMirror commented 2026-03-13 08:20:57 -05:00
Author
Owner
Copy Link

@Bekacru commented on GitHub (Apr 17, 2025):

for session token
format -> "value.signature"

step1: separate with '.' delimeter
step2: decode
step3: take the value and validate the signature using hmac with your BA Secret Key

@Bekacru commented on GitHub (Apr 17, 2025): for session token format -> "value.signature" step1: separate with '.' delimeter step2: decode step3: take the value and validate the signature using hmac with your BA Secret Key
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#1063
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?