Add JWT authentication middleware plugin

[0xReLogic]

Description

Add a JWT (JSON Web Token) authentication middleware plugin to secure backend APIs with token-based authentication.

Requirements

• Implement JWT plugin in internal/plugins/jwt.go (single file, not a subdirectory)
• Support HS256, RS256, ES256 signing algorithms
• Validate token expiration, issuer, audience
• Extract claims and add to request context
• Support token from Authorization header or cookie
• Register plugin using RegisterBuiltin() in init() function

Implementation Guide

File Structure

Create a single file: internal/plugins/jwt.go

Important: Do NOT create a subdirectory like internal/plugins/jwt/. All plugins are implemented as single .go files directly in the internal/plugins/ directory, following the same pattern as existing plugins:

• internal/plugins/headers.go
• internal/plugins/logging.go
• internal/plugins/example_authentication.go

Plugin Registration Pattern

Your plugin must follow this pattern:

package plugins

import (
    "net/http"
    // ... other imports
)

func init() {
    RegisterBuiltin("jwt", func(name string, cfg map[string]interface{}) (Middleware, error) {
        // 1. Parse and validate configuration
        secret, ok := cfg["secret"].(string)
        if !ok || secret == "" {
            return nil, fmt.Errorf("secret is required for jwt plugin")
        }
        
        // 2. Initialize JWT validator with config
        // ... your JWT setup code
        
        // 3. Return middleware function
        return func(next http.Handler) http.Handler {
            return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
                // Your JWT validation logic here
                // If valid: next.ServeHTTP(w, r)
                // If invalid: http.Error(w, "Unauthorized", http.StatusUnauthorized)
            })
        }, nil
    })
}

Configuration Example

plugins:
  enabled: true
  chain:
    - name: jwt
      config:
        secret: "your-secret-key"  # For HS256
        algorithm: "HS256"  # HS256, RS256, ES256
        issuer: "helios"
        audience: "api"
        token_lookup: "header:Authorization,cookie:token"
        claims_header: "X-JWT-Claims"

Acceptance Criteria

• JWT validation plugin implementation in internal/plugins/jwt.go
• Support for multiple signing algorithms (HS256, RS256, ES256)
• Plugin registered using RegisterBuiltin() in init() function
• Unit tests with valid/invalid tokens in internal/plugins/jwt_test.go
• Documentation in docs/plugin-development.md
• Example usage with token generation

Reference Examples

Look at these existing plugins for implementation patterns:

• internal/plugins/headers.go - Simple plugin with config parsing
• internal/plugins/logging.go - Plugin with request/response handling
• internal/plugins/example_authentication.go - Authentication pattern example

JWT Library

Use the official Go JWT library:

go get github.com/golang-jwt/jwt/v5

References

• https://github.com/golang-jwt/jwt
• https://jwt.io/introduction
• Existing plugin examples in internal/plugins/

[fatihozcann]

Hey! I was wondering if this project is still being maintained? I'd love to contribute to this issue if it's still open for PRs. Thanks!

[0xReLogic]

Hey @fatihozcann Yeah the project is still active, feel free to take this one if you'd like to work on it. Thanks