Security Best Practices Summary

OWASP-oriented checklist for Go HTTP and gRPC APIs.

Apply these rules in service templates, code review, and CI so every Go API fails closed and ships with measurable supply-chain hygiene.

How to Use This List

• Tick items as your org's Go service template adopts them.
• Encode Tier A controls in CI (govulncheck, lint, integration tests for auth).
• Map Tier B items to OWASP API Security Top 10 categories in your risk register.
• Revisit when exposing new public routes, adding browser clients, or onboarding gRPC services.

A - Transport and server hardening

• Set ReadHeaderTimeout on every production http.Server. Blocks slow header attacks before handlers execute.
• Configure ReadTimeout, WriteTimeout, and IdleTimeout per SLO. Prevents hung connections and descriptor leaks.
• Set tls.Config.MinVersion to TLS 1.2 or higher on TLS listeners. Documents acceptable protocol floor for audits.
• Serve complete certificate chains and monitor NotAfter dates. Incomplete chains cause client failures; expiry causes outages.
• Use mTLS or mesh identity for service-to-service calls when the threat model requires it. Network location is not authentication.
• Never set InsecureSkipVerify on production outbound clients. Disables certificate and hostname verification.
• Inject configured http.Client instances with timeouts; never http.DefaultClient in handlers. Default client has no deadline.

B - Authentication and authorization

• Authenticate in middleware before business handlers; fail closed on missing credentials. Returns 401, never anonymous fallback on protected routes.
• Return 403 when authenticated users lack permission; reserve 401 for auth failures. Clear semantics aid clients and monitoring.
• Pin JWT algorithms in validation; reject unexpected alg values. Prevents algorithm confusion attacks.
• Use short-lived access tokens and a documented rotation or revocation strategy. Limits stolen token blast radius.
• Check resource-level authorization, not only global roles. Prevents IDOR even when role: user is present.
• Protect /metrics, /debug, and admin routes with the same auth rigor as APIs. Attackers scan defaults.
• Store context principals with unexported key types. Avoids string-key collisions across middleware packages.

C - Input, output, and data

• Cap request bodies with http.MaxBytesReader before decode. Rejects oversized payloads early.
• Validate JSON with typed DTOs plus semantic rules after syntax parse. Valid JSON can still be dangerous.
• Use DisallowUnknownFields on strict public APIs when appropriate. Surfaces client bugs and probing.
• Parameterize all SQL; never format queries with user input. Stops SQL injection at the source.
• Render HTML with html/template, not text/template. Auto-escapes content in HTML context.
• Return generic error messages to clients; log details server-side with request IDs. Prevents information leakage.
• Avoid mass assignment: separate public input structs from persistence models. Blocks privilege escalation via JSON fields.

D - Browser and edge controls

• Set session cookies HttpOnly, Secure, and appropriate SameSite. Reduces XSS exfiltration and cross-site cookie abuse.
• Require CSRF tokens on cookie-authenticated mutating requests. Browsers send cookies automatically; CORS does not stop CSRF.
• Allowlist CORS origins; never reflect arbitrary Origin values. Open CORS plus cookies enables data theft.
• Apply security headers (CSP, HSTS, X-Content-Type-Options, frame ancestors) on all responses including errors. Headers must not depend on success paths only.
• Rate limit login and expensive endpoints more aggressively than health checks. Slows credential stuffing and abuse.
• Trust X-Forwarded-For only from known load balancers. Prevents client IP spoofing for rate limits and audit logs.

E - Secrets and configuration

• Load secrets from environment or secret managers; never commit credentials. Fail process start when required secrets are missing.
• Compare API keys and HMACs with crypto/subtle.ConstantTimeCompare. Reduces timing side channels.
• Hash passwords with bcrypt or argon2 via golang.org/x/crypto. Never store or compare plaintext passwords.
• Redact tokens and PII from structured logs. Logs become a secondary breach channel.
• Separate dev and prod keys; rotate on employee departure and incidents. Limits blast radius of leaked config.

F - Supply chain and operations

• Run govulncheck ./... in CI and fail on actionable reachable findings. Catches known CVEs in your import graph.
• Commit go.sum and run go mod verify in CI. Detects module tampering at download.
• Generate and store SBOM per release artifact. Speeds incident response and audit evidence.
• Pin Go toolchain version in CI images matching go.mod. Security patches land in Go patch releases.
• Review replace directives and private forks as first-party code. Bypass normal module provenance checks.
• Document exception allowlists for vuln findings with owners and expiry. Prevents permanent "temporary" waivers.

FAQs

Related

• Security for Go Services: Defaults and Gaps - conceptual security model
• Go Security Basics - runnable starting snippets
• Authentication & Authorization Patterns - auth middleware patterns
• Dependency Scanning with govulncheck & SBOM - CI scanning detail
• crypto/tls Configuration & Certificate Management - TLS and mTLS depth

Stack versions: This page was written for Go 1.26.x (Green Tea GC default, go fix modernizers - verify patch at build), chi (latest - verify at build), gin (latest - verify at build), echo (latest - verify at build), google.golang.org/grpc (latest - verify at build), sigs.k8s.io/controller-runtime (latest - verify at build), kubebuilder (latest - verify at build), tinygo (latest - verify board targets at build), wazero (latest - verify at build), and golangci-lint (latest - verify at build).