# Full Stack Authentication

**URL:** <https://community.auth0.com/t/full-stack-authentication/99425>\
**Category:** Get Help\
**Tags:** clients, management-api\
**Created:** [January 31, 2023, 11:45pm UTC](https://community.auth0.com/t/full-stack-authentication/99425 "2023-01-31T23:45:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![atiqulakash](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/atiqulakash/32/44204_2.png) [@atiqulakash](https://community.auth0.com/u/atiqulakash)\
**Post date:** [January 31, 2023, 11:45pm UTC](https://community.auth0.com/t/full-stack-authentication/99425/1 "2023-01-31T23:45:16Z")

</div>

I am working on an application. I have a React Typescript frontend and a Golang backend.  
I trying to integrate Auth0 for authentication.

I created an SPA and named it app\_client on Auth0 and used the clientID and domainID as my client ID and domain ID for the react client side. I also created a new api and named it app\_server. I used the app\_server Identifier as the audience for both the client and the server side of my application.

I am using `useAuth0.GetAccessTokenSilently` on the react end to get the token, however the backend is errors out 'Error parsing token: Invalid audience.`  
I tested by hardcoding the test token from Auth0 and that does work.

Below is the react code for AUTH0 setup

```auto
ReactDOM.createRoot(document.getElementById('root') as HTMLElement).render(
  <React.StrictMode>
    <BrowserRouter>
      <Auth0Provider
        domain=domain
        clientId=clientId
        authorizationParams={{
          audience: audience,
          redirect_uri: window.location.origin
        }}
      >
        <App />
      </Auth0Provider>
    </BrowserRouter>
  </React.StrictMode>,
)

```

Code for golang AUTH0 middleware

```auto
func main() {
	log.Println(os.Getenv("AUTH0_API_AUDIENCE"))
	jwtMiddleware := jwtmiddleware.New(jwtmiddleware.Options{
		ValidationKeyGetter: func(token *jwt.Token) (interface{}, error) {
			aud := os.Getenv("AUTH0_API_AUDIENCE")
			checkAudience := token.Claims.(jwt.MapClaims).VerifyAudience(aud, false)
			if !checkAudience {
				return token, errors.New("Invalid audience.")
			}
			// verify iss claim
			iss := os.Getenv("AUTH0_DOMAIN")
			checkIss := token.Claims.(jwt.MapClaims).VerifyIssuer(iss, false)
			if !checkIss {
				return token, errors.New("Invalid issuer.")
			}
			cert, err := getPemCert(token)
			if err != nil {
				log.Fatalf("could not get cert: %+v", err)
			}
			result, _ := jwt.ParseRSAPublicKeyFromPEM([]byte(cert))
			return result, nil
		},
		SigningMethod: jwt.SigningMethodRS256,
	})
	jwtMiddleWare = jwtMiddleware
	// Set the router as the default one shipped with Gin
	router := gin.Default()
	router.Use(cors.New(cors.Config{
		AllowMethods: []string{"POST"},
		AllowHeaders: []string{"*"},
		ExposeHeaders: []string{"Content-Length"},
		AllowCredentials: true,
		AllowAllOrigins: true,
	}))

	router.POST("/does-user-exists", authMiddleware(), controllers.DoesUserExists)
	log.Fatal(router.Run(":8081"))
}

func getPemCert(token *jwt.Token) (string, error) {
	cert := ""
	resp, err := http.Get(os.Getenv("AUTH0_DOMAIN") + ".well-known/jwks.json")
	if err != nil {
		return cert, err
	}
	defer resp.Body.Close()
	var jwks = Jwks{}
	err = json.NewDecoder(resp.Body).Decode(&jwks)
	if err != nil {
		return cert, err
	}
	x5c := jwks.Keys[0].X5c
	for k, v := range x5c {
		if token.Header["kid"] == jwks.Keys[k].Kid {
			cert = "-----BEGIN CERTIFICATE-----\n" + v + "\n-----END CERTIFICATE-----"
		}
	}
	if cert == "" {
		return cert, errors.New("unable to find appropriate key")
	}
	return cert, nil
}

// authMiddleware intercepts the requests, and check for a valid jwt token
func authMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		// Get the client secret key
		err := jwtMiddleWare.CheckJWT(c.Writer, c.Request)
		if err != nil {
			// Token not found
			fmt.Println(err)
			c.Abort()
			c.Writer.WriteHeader(http.StatusUnauthorized)
			c.Writer.Write([]byte("Unauthorized"))
			return
		}
	}
}

```

Note: For the AUTH0\_Domain configuration on the backend Go server I used https:// **domain** /, where domain is the Auth0 Domain

Any suggestion would be greatly appreciated.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [February 6, 2023, 8:51pm UTC](https://community.auth0.com/t/full-stack-authentication/99425/3 "2023-02-06T20:51:49Z")

</div>

Hi @atiqulakash,

Welcome to the Auth0 Community!

The first thing I would do is take a look at the token you are receiving. Does it contain the audience you are expecting?

You can use [jwt.io](http://jwt.io) to parse the token.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 28, 2023, 1:23pm UTC](https://community.auth0.com/t/full-stack-authentication/99425/4 "2023-03-28T13:23:18Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.