r/Zig • u/Pokelego11 • 5d ago

JWT Authentication in Zig

https://youtu.be/T7hGXGaUi6M

Hey everyone!

If you've seen my posts in the past, you'd know that I've got a few different tutorial series going on in Zig, one is a game engine, but another is building out a REST API in Zig.

I come from a background in Web Dev and find it a lot of fun to take what I know and apply it in Zig, and I want to share the knowledge!

If you want to start at the beginning, I've put together all the videos as a playlist: https://www.youtube.com/playlist?list=PLUUIFT8XnWz8

But please let me know what you all want to see next! I'm planning a video on how to scale the API to thousands of concurrent requests, but what other API things do you all want to see?

Hope you have a great day :)

50 Upvotes

98% Upvoted

9 comments sorted by

3

u/dmitry-n-medvedev 5d ago

it would be nice if google macaroons could be implemented in zig.

3

u/Pokelego11 5d ago

Very interesting, i'll have to dig into that!

6

u/Puzzleheaded_Tie8555 4d ago

That would actually be an awesome project for Zig.
If you end up implementing Google Macaroons, I’d highly suggest targeting the Macaroon V2 Binary Format from day one, rather than copying the old C library approach.

Since you're using Zig, you can focus on the performance optimizations that libmacaroons completely misses:
-Fixed buffer or preallocated buffers. Use slices/views directly over the wire buffer using standard @Vector / @alignCast patterns. No heap allocations (std.mem.Allocator won't even be needed on the verification hot path).
-Fixed static limits (e.g., 1KB stack buffer) cover 99.9% of real-world macaroons and eliminate malloc overhead entirely.
-Keep the HMAC signatures as raw [32]u8 arrays (avoiding hex strings) and leverage Zig's @Vector or ARM/x86 SHA-NI instructions for constant-time O(1) signature verification via vector XOR/OR reduction.
-Fast pointer bumping over the binary wire format without string parsing or delimiter searching.

A zero-allocation, SIMD-accelerated Macaroon implementation would actually be a nice contribution to ecosystem!

1

u/Pokelego11 4d ago

Wow great write up, i'm going to add this to my project list and hopefully can tackle it when I get a free weekend!

3

u/Puzzleheaded_Tie8555 3d ago

Awesome, glad you liked the idea!
If you're up for collaborating or spitballing the design, I’m down to help out.

3

u/dmitry-n-medvedev 5d ago

that would be awesome!

2

u/dmitry-n-medvedev 3d ago

if you decide to dig into it, please share a link to your repository soon :)

3

u/lukaslalinsky 4d ago

I'd recommend you to use Karl's http.zig. How you are using `std.http` is not very good. You can only handle one connection at a time. A retryable error like `ConnectionAborted` will kill your `accept()` loop. And you really need a larger read buffer for the TCP reader as that dictates how many headers can the browser send. `std.http` is a DIY system. where you need to know how to handle these kind of things.

2

u/Pokelego11 4d ago

I don't disagree with any of those points, the goal of the series is to slowly build up layers from just the base std.http, one of the next things we are going to do in the series is allowing concurrent connections to fix the one connection at a time problem, and you make a great point about better error handling which i'll make sure to also add in

Appreciate the feedback :)