安全与认证

TLS 加密

服务端配置

import "google.golang.org/grpc/credentials"

creds, _ := credentials.NewServerTLSFromFile("server.crt", "server.key")
s := grpc.NewServer(grpc.Creds(creds))

客户端配置

creds, _ := credentials.NewClientTLSFromFile("ca.crt", "example.com")
conn, _ := grpc.Dial("localhost:50051", grpc.WithTransportCredentials(creds))

Token 认证

import "google.golang.org/grpc/metadata"

// 客户端发送 Token
md := metadata.New(map[string]string{
    "authorization": "bearer token123",
})
ctx := metadata.NewOutgoingContext(context.Background(), md)

// 服务端验证
md, ok := metadata.FromIncomingContext(ctx)
if !ok {
    return nil, status.Error(codes.Unauthenticated, "missing metadata")
}
tokens := md.Get("authorization")

拦截器认证

func AuthInterceptor(ctx context.Context, req interface{}, 
    info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
    
    md, ok := metadata.FromIncomingContext(ctx)
    if !ok {
        return nil, status.Error(codes.Unauthenticated, "missing token")
    }
    
    // 验证 token
    token := md.Get("authorization")[0]
    if !validateToken(token) {
        return nil, status.Error(codes.Unauthenticated, "invalid token")
    }
    
    return handler(ctx, req)
}

参考：https://grpc.io/docs/