# Go-jwt-middleware CustomClaims validation type failure

**URL:** <https://community.auth0.com/t/go-jwt-middleware-customclaims-validation-type-failure/116530>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [September 18, 2023, 6:57pm UTC](https://community.auth0.com/t/go-jwt-middleware-customclaims-validation-type-failure/116530 "2023-09-18T18:57:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbonnet](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@mbonnet](https://community.auth0.com/u/mbonnet)\
**Post date:** [September 18, 2023, 6:57pm UTC](https://community.auth0.com/t/go-jwt-middleware-customclaims-validation-type-failure/116530/1 "2023-09-18T18:57:23Z")

</div>

I have a Go backend that uses github user zett-8’s [go-clean-echo](https://github.com/zett-8/go-clean-echo/) as a template. Their template uses a middleware explicitly using auth0. I have a React frontend that properly uses auth0 for login and for getting JWT tokens to interact with the backend, which uses an auth0 API in the jwt middleware.

I am attempting to use logic from [the example](https://auth0.com/docs/quickstart/backend/golang/01-authorization#create-a-middleware-to-validate-access-tokens), though in an Echo-y way. So, I am having problems extracting the CustomClaims.

The middleware is as follows:

```auto
package middlewares

import (
	"context"
	"fmt"
	"log"
	"net/http"
	"net/url"
	"os"
	"strings"
	"time"

	"tlmgateway/logger"

	"github.com/auth0/go-jwt-middleware/v2/jwks"
	"github.com/auth0/go-jwt-middleware/v2/validator"
	"github.com/labstack/echo/v4"
	"go.uber.org/zap"
	// "github.com/zett-8/go-clean-echo/configs"
)

// CustomClaims contains custom data we want from the token.
type CustomClaims struct {
	Scope string `json:"scope" form:"scope"`
	Permissions []string `json:"permissions" form:"permissions"`
}

// Validate does nothing for this example, but we need
// it to satisfy validator.CustomClaims interface.
func (c CustomClaims) Validate(ctx context.Context) error {
	return nil
}

func JwtMiddleware() (echo.MiddlewareFunc, error) {
	issuerURL, err := url.Parse("https://" + os.Getenv("AUTH0_DOMAIN") + "/")
	if err != nil {
		log.Fatalf("Failed to parse the issuer url: %v", err)
	}

	provider := jwks.NewCachingProvider(issuerURL, 5*time.Minute)

	jwtValidator, err := validator.New(
		provider.KeyFunc,
		validator.RS256,
		issuerURL.String(),
		[]string{os.Getenv("AUTH0_AUDIENCE")},
		validator.WithCustomClaims(
			func() validator.CustomClaims {
				return &CustomClaims{}
			},
		),
		validator.WithAllowedClockSkew(time.Minute),
	)
	if err != nil {
		log.Fatalf("Failed to set up the jwt validator")
	}

	return func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {

			authorization := c.Request().Header.Get("Authorization")
			if authorization == "" {
				return echo.NewHTTPError(http.StatusUnauthorized, "No Authorization Header")
			}

			if !strings.HasPrefix(authorization, "Bearer ") {
				return echo.NewHTTPError(http.StatusUnauthorized, "Invalid Authorization Header")
			}

			token := strings.TrimPrefix(authorization, "Bearer ")

			claims, err := jwtValidator.ValidateToken(c.Request().Context(), token)
			if err != nil {
				logger.Error("Invalid Token: ", zap.Error(err))
				return echo.NewHTTPError(http.StatusUnauthorized, "Invalid Token")
			}

			c.Set("claims", claims.(*validator.ValidatedClaims))
			c.Set("customClaims", claims.(*validator.CustomClaims))

			return next(c)
		}
	}, nil
}

// HasScope checks whether our claims have a specific scope.
func (c CustomClaims) HasScope(expectedScope string) bool {
	result := strings.Split(c.Scope, " ")
	for i := range result {
		if result[i] == expectedScope {
			return true
		}
	}

	return false
}

// HasPermission checks whether our claims have a specific permission.
func (c CustomClaims) HasPermission(expectedPermission string) bool {
	for _, permission := range c.Permissions {
		if permission == expectedPermission {
			return true
		}
	}

	return false
}

```

When the API using this middleware is hit, I get the following error:

`interface conversion: interface {} is *validator.ValidatedClaims, not *validator.CustomClaims`

Which is perplexing, given that the type of \*validator.CustomClaims should theoretically indeed be of type CustomClaims.

Do I need to actually implement `Validate` properly, unlike what the comments say in the auth0 example (copied over to my code)? How would I get `ValidateToken` to give back a CustomClaims struct somewhere?

---

<div class="post-metadata">

**Author:** ![mbonnet](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@mbonnet](https://community.auth0.com/u/mbonnet)\
**Post date:** [September 19, 2023, 5:28pm UTC](https://community.auth0.com/t/go-jwt-middleware-customclaims-validation-type-failure/116530/2 "2023-09-19T17:28:27Z")

</div>

OP here. Solution was to instead use the auth0 example almost line-for-line, but instead of using the `EnsureValidToken()` handler function as middleware (which doesn’t play nice with Echo), to simply wrap `EnsureValidToken()` in Echo’s very useful `echo.WrapMiddleware` function.

```auto
func EchoEnsureValidToken() (echo.MiddlewareFunc, error) {
	mw := echo.WrapMiddleware(EnsureValidToken())
	return mw, nil
}

```

And simply use that middleware for an endpoint or group or the entire set of handlers.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [September 19, 2023, 8:15pm UTC](https://community.auth0.com/t/go-jwt-middleware-customclaims-validation-type-failure/116530/3 "2023-09-19T20:15:16Z")

</div>

Hey @mbonnet glad you were able to get this sorted, and thanks for following up with the solution!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 3, 2023, 8:16pm UTC](https://community.auth0.com/t/go-jwt-middleware-customclaims-validation-type-failure/116530/4 "2023-10-03T20:16:09Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.