I'm building a desktop application with electron/react, which allows the users to sign up/login, but only if they have a specific email domain ([email protected]). I have a working API written in golang that can successfully serve GET requests. As for authentication, I've tried mapping out my authentication flow, but I'm at a point where I just don't know what to do next. Here's my poorly constructed method:

Sign In

-User fills out form with information

-If email domain is valid, A token is generated on the client (I'm not sure if this is really a correct way to do it. I think it might be better to have the serve generate the token, but then wouldn't I have to implement some sort of table of users currently signing up?)

-Token is emailed to the address they signed up with via smtp service

-App navigates to validation screen


-User enters token and it is checked against the generated token

-If token is correct, we send credentials to to backend to generate a user field.

Here is where i kinda just stumped myself. How do I tell the API that it is okay to enter in this user? I could send it a JWT token but from what I understand, you do not wanna do that on the front end. However, I feel like I could solve a lot of problems if my front end could simply add verification to a get request.

If anyone has any articles I could read to steer me in the right direction, I would appreciate it! Thank you!

1 Answer 1


It looks like you are trying to reinvent the wheel.

If you have a web-service that must be protected, you can take a look at OASIS Web Services Security specification.
This specification cover web services authentication at Message level. All the authentication is done through the values in the messages exchanged.

Also, you can configure additional layers by securing the channel, for example using HTTPS, so MIM is mitigated on the messages exchanged.

The JWT option is valid, but you should be generating the token in the server. Most likely, the user should authenticate first (with user/password, for example) to get a token.
The token should be signed by your server's certificate and every time you receive a token, you should validate that the token was signed by your server's certificate.

  • 1
    I was afraid I might be reinventing the wheel. I'll authenticate a different method and go ahead with that JWT option. Seems like the most optimal flow. thanks!
    – Techy Ty
    Commented Feb 12, 2020 at 16:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .