Method generateAccessToken

auth_jwt.go:816–862

generateAccessToken method that clients can use to get a jwt token.

(data any)

// generateAccessToken method that clients can use to get a jwt token.
func (mw *GinJWTMiddleware) generateAccessToken(data any) (string, time.Time, error) {
	// 1. Validate signing algorithm
	signingMethod := jwt.GetSigningMethod(mw.SigningAlgorithm)
	if signingMethod == nil {
		return "", time.Time{}, ErrInvalidSigningAlgorithm
	}

	token := jwt.New(signingMethod)
	claims, ok := token.Claims.(jwt.MapClaims)
	if !ok {
		return "", time.Time{}, ErrFailedTokenCreation
	}

	// 2. Define framework-controlled claims that PayloadFunc cannot overwrite
	// Only claims that the framework calculates/manages internally are reserved.
	// Standard JWT claims (sub, iss, aud, nbf, iat, jti) are allowed to be set by users
	// via PayloadFunc to comply with RFC 7519 best practices.
	frameworkClaims := map[string]bool{
		"exp":      true, // Framework calculates expiration time
		"orig_iat": true, // Framework uses this for refresh mechanism
	}

	// 3. Safely add custom payload, avoiding framework-controlled field overwrites
	if mw.PayloadFunc != nil {
		for key, value := range mw.PayloadFunc(data) {
			if !frameworkClaims[key] {
				claims[key] = value
			}
		}
	}

	// 4. Calculate expiration time using original data instead of claims
	expire := mw.TimeFunc().Add(mw.TimeoutFunc(data))

	// 5. Set required system claims
	now := mw.TimeFunc()
	claims[mw.ExpField] = expire.Unix()
	claims["orig_iat"] = now.Unix()

	// 6. Sign the token
	tokenString, err := mw.signedString(token)
	if err != nil {
		return "", time.Time{}, err
	}

	return tokenString, expire, nil
}

// TokenGenerator generates a complete token pair (access + refresh) with RFC 6749 compliance
func (mw *GinJWTMiddleware) TokenGenerator(ctx context.Context, data any) (*core.Token, error) {