Web token authentication in Golang
Go Code Review Comments
  
  Don't Panic
  
  Don't use panic for normal error handling. Use error and multiple
  return values.


func Make(object interface{}) string {
    payloadBytes, err := json.Marshal(object)
    if err != nil {
        panic(err)
    }
    payload := base64.StdEncoding.EncodeToString(payloadBytes)
    return payload + "." + sign(payload)
}


I'm going to exploit this, an exported function that panics, to crash your application.

func sign(s string) string {
    h := hmac.New(sha256.New, []byte("secret"))
    h.Write([]byte(s))
    return base64.StdEncoding.EncodeToString(h.Sum(nil))
}


I'm going use a literal embedded in your executable, []byte("secret"), to break your authentication.