Verifying a session

Protect Your Backend APIs

Go makes it really easy to create a simple HTTP server, and Clerk makes it really easy to authenticate any request. In the following example you can learn how to verify a session and retrieve the corresponding user.

.env1
package main
2

3
import (
4
	"net/http"
5
	"strings"
6
	
7
	"github.com/clerkinc/clerk-sdk-go/clerk"
8
)
9

10
func main() {
11
	client, _ := clerk.NewClient("your_secret_key")
12

13
	http.HandleFunc("/hello", func(w http.ResponseWriter, r *http.Request) {
14
		// get session token from Authorization header
15
		sessionToken := r.Header.Get("Authorization")
16
		sessionToken = strings.TrimPrefix(sessionToken, "Bearer ")
17
		
18
		// verify the session
19
		sessClaims, err := client.VerifyToken(sessionToken)
20
		if err != nil {
21
			w.WriteHeader(http.StatusUnauthorized)
22
			w.Write([]byte("Unauthorized"))
23
			return
24
		}
25

26
		// get the user, and say welcome!
27
		user, err := client.Users().Read(sessClaims.Claims.Subject)
28
		if err != nil {
29
			panic(err)
30
		}
31

32
		w.Write([]byte("Welcome " + *user.FirstName))
33
	})
34

35
	http.ListenAndServe(":8080", nil)
36
}
37

Using middleware

The Clerk SDK also provides a simple middleware that adds the active session to the request's context.

.env1
package main
2

3
import (
4
	"net/http"
5
	
6
	"github.com/clerkinc/clerk-sdk-go/clerk"
7
)
8

9
func main() {
10
	client, _ := clerk.NewClient("your_secret_key")
11
	
12
	mux := http.NewServeMux()
13

14
	injectActiveSession := clerk.WithSession(client)
15
	mux.Handle("/hello", injectActiveSession(helloUserHandler(client)))
16

17
	http.ListenAndServe(":8080", mux)
18
}
19

20
func helloUserHandler(client clerk.Client) http.HandlerFunc {
21
	return func(w http.ResponseWriter, r *http.Request) {
22
		ctx := r.Context()
23
		
24
		sessClaims, ok := ctx.Value(clerk.ActiveSessionClaims).(*clerk.SessionClaims)
25
		if !ok {
26
			w.WriteHeader(http.StatusUnauthorized)
27
			w.Write([]byte("Unauthorized"))
28
			return
29
		}
30

31
		user, err := client.Users().Read(sessClaims.Claims.Subject)
32
		if err != nil {
33
			panic(err)
34
		}
35

36
		w.Write([]byte("Welcome " + *user.FirstName))
37
	}
38
}
39