OAuth2 Login - go-security

Wires go-security’s OAuth2/OIDC login client into a plain net/http server: a Google registration (OIDC), a Zalo registration (plain OAuth2, VNG ecosystem), and a local “dev” registration pointed at an in-process fake provider so the whole flow runs end-to-end with no real credentials.

go run ./examples/oauth2login

Then visit http://localhost:8080/ and click the “dev” login link.

The Google and Zalo ClientRegistrations use placeholder client ID/secret strings ("GOOGLE_CLIENT_ID", "ZALO_APP_ID", …) — literal values, not environment variables. Swap in real credentials from each provider’s console before those two links will work; only the “dev” link is wired to a functioning provider in this example.

Registrations

// Google (OIDC): built from the preset. Credentials are placeholders here;
// supply real ones from the Google Cloud console in production.
google, err := oauth2.NewRegistration(
    "google", oauth2.ProviderGoogle,
    "GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET",
    "http://localhost:8080/login/oauth2/code/google",
    nil, // nil scopes → preset default {openid, profile, email}
    oauth2.AuthMethodClientSecretBasic,
)

// Zalo (plain OAuth2 — no OIDC id_token): built from the preset.
zalo, err := oauth2.NewRegistration(
    "zalo", oauth2.ProviderZalo,
    "ZALO_APP_ID", "ZALO_APP_SECRET",
    "http://localhost:8080/login/oauth2/code/zalo",
    []string{"id", "name", "picture"},
    oauth2.AuthMethodClientSecretPost,
)

// A local "dev" registration pointed at the fake provider so the example
// runs end-to-end. AllowInsecure permits the http:// fake endpoints.
dev := oauth2.ClientRegistration{
    ID:                "dev",
    Provider:          oauth2.ProviderGeneric,
    ClientID:          "dev-client",
    ClientSecret:      "dev-secret",
    AuthMethod:        oauth2.AuthMethodClientSecretPost,
    AuthorizationURI:  devProvider.URL + "/authorize",
    TokenURI:          devProvider.URL + "/token",
    UserInfoURI:       devProvider.URL + "/userinfo",
    RedirectURI:       "http://localhost:8080/login/oauth2/code/dev",
    Scopes:            []string{"profile", "email"},
    UserNameAttribute: "id",
    AllowInsecure:     true, // dev only: permits the http:// fake endpoints.
}

repo, err := oauth2.NewInMemoryClientRegistrationRepository(google, zalo, dev)

Handlers

authz := oauth2.NewAuthorizationRequestHandler(repo, store, cookie)

loginCfg := oauth2.LoginConfig{
    Repo:   repo,
    Store:  store,
    Cookie: cookie,
    OnSuccess: func(w http.ResponseWriter, r *http.Request, tok *oauth2.OAuth2Token) {
        log.Printf("login success: registration=%s subject=%s authorities=%v",
            tok.RegistrationID(), tok.Name(), tok.Authorities())
    },
    OnFailure: func(w http.ResponseWriter, r *http.Request, err error) {
        // Never reflect the provider error_description; surface a fixed code.
        log.Printf("login failure: %v", err)
        http.Error(w, "login failed", http.StatusUnauthorized)
    },
}

mux := http.NewServeMux()
mux.HandleFunc("/", indexHandler(repo))

// Authorization-request initiators: GET /oauth2/authorization/{id}.
for _, reg := range repo.Registrations() {
    id := reg.ID
    mux.Handle("/oauth2/authorization/"+id, authz.Handle(id))
    // Callbacks: GET /login/oauth2/code/{id}. CSRF-exempt by design.
    mux.Handle("/login/oauth2/code/"+id, oauth2.CallbackHandler(loginCfg, id))
}

// Wrap everything in a middleware Chain (default security headers).
chain := middleware.New(middleware.SecurityHeaders())
handler := chain.Then(mux)

There is no authn.UserService, no securityhttp.New/NewHandler, and no WithLogin option in this example — the OAuth2 callback handler writes the session principal directly once the code exchange and userinfo fetch succeed.

CSRF note

The callback route (/login/oauth2/code/{id}) is intentionally CSRF-exempt: the single-use, session-bound, constant-time state value is the CSRF defense for the authorization-code flow. If you mount web/csrf in your own app, exclude /login/oauth2/code/* from it.

The fake “dev” provider

newFakeProvider starts an httptest.Server implementing just enough of a non-OIDC OAuth2 provider for the “dev” registration to complete a real PKCE login with no external IdP:

GET  /authorize → 302 to redirect_uri?code=fake-auth-code&state=<mirrored>
POST /token     → {"access_token":"fake-access-token","token_type":"Bearer",...}
GET  /userinfo  → {"id":"12345","name":"Dev User","email":"dev@example.com"}

It performs no real authentication or PKCE verification — it exists purely so the example is runnable end-to-end.

Flow diagram

User clicks "dev" login link
  │
  ▼
GET /oauth2/authorization/dev?next=/welcome
  │  (generates state + PKCE verifier, stores in session)
  ▼
302 → <fake provider>/authorize?...&code_challenge=...
  │
  ▼  (fake provider immediately redirects back with a code)
  │
GET /login/oauth2/code/dev?code=fake-auth-code&state=...
  │  (verifies state, exchanges code for tokens + PKCE verifier)
  │  (fetches userinfo, stores principal in session)
  ▼
302 → /welcome (authenticated)

​Registrations

​Handlers

​CSRF note

​The fake “dev” provider

​Flow diagram

Registrations

Handlers

CSRF note

The fake “dev” provider

Flow diagram