Go Security

ALWAYS:

• Use parameterized queries for SQL
• Validate and sanitize all user input
• Set timeouts on HTTP clients
• Use bcrypt for password hashing
• Load secrets from environment variables
• Run gosec and govulncheck before deployment

Quick Reference

Secret Management

// NEVER: Hardcoded secrets
apiKey := "sk-proj-xxxxx"

// ALWAYS: Environment variables
apiKey := os.Getenv("API_KEY")
if apiKey == "" {
    return errors.New("API_KEY not configured")
}

SQL Injection Prevention

// BAD: String concatenation
query := fmt.Sprintf("SELECT * FROM users WHERE id = %s", userID)

// GOOD: Parameterized queries
query := "SELECT * FROM users WHERE id = ?"
db.Query(query, userID)

// GOOD: Using sqlx named queries
query := "SELECT * FROM users WHERE id = :id"
db.NamedQuery(query, map[string]interface{}{"id": userID})

Command Injection Prevention

// BAD: User input in shell command
cmd := exec.Command("sh", "-c", "ping " + userInput)

// GOOD: Separate arguments, no shell
cmd := exec.Command("ping", "-c", "1", userInput)

// BETTER: Validate input first
if !isValidHostname(userInput) {
    return errors.New("invalid hostname")
}

Path Traversal Prevention

// BAD: Direct user input in file path
path := filepath.Join("/uploads", userInput)

// GOOD: Clean and validate
cleanPath := filepath.Clean(userInput)
if strings.Contains(cleanPath, "..") {
    return errors.New("invalid path")
}
fullPath := filepath.Join("/uploads", filepath.Base(cleanPath))

Race Condition Prevention

// BAD: Check-then-act without lock
if balance >= amount {
    withdraw(amount)  // Race condition!
}

// GOOD: Database transaction with row lock
tx, _ := db.BeginTx(ctx, nil)
defer tx.Rollback()

var balance int
tx.QueryRow("SELECT balance FROM accounts WHERE id = ? FOR UPDATE", id).Scan(&balance)
if balance < amount {
    return ErrInsufficientFunds
}
tx.Exec("UPDATE accounts SET balance = balance - ? WHERE id = ?", amount, id)
tx.Commit()

Context Timeouts

// GOOD: Always set timeouts for external calls
ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
defer cancel()

resp, err := client.Do(req.WithContext(ctx))

HTTP Client Security

// BAD: Default client has no timeout
resp, _ := http.Get(url)

// GOOD: Custom client with timeout
client := &http.Client{
    Timeout: 10 * time.Second,
    CheckRedirect: func(req *http.Request, via []*http.Request) error {
        return http.ErrUseLastResponse
    },
}

TLS Configuration

tlsConfig := &tls.Config{
    MinVersion: tls.VersionTLS12,
    CipherSuites: []uint16{
        tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
    },
}

Password Hashing

// BAD: Weak hash
hash := md5.Sum([]byte(password))

// GOOD: Use bcrypt
hash, _ := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)

// Verify
err := bcrypt.CompareHashAndPassword(hash, []byte(password))

Input Validation

// Validate before use
func processID(input string) (UserID, error) {
    id, err := strconv.ParseInt(input, 10, 64)
    if err != nil {
        return 0, fmt.Errorf("invalid ID format: %w", err)
    }
    
    if id <= 0 {
        return 0, errors.New("ID must be positive")
    }
    
    return UserID(id), nil
}

CSRF Protection

// Generate token
token := make([]byte, 32)
rand.Read(token)
csrfToken := base64.URLEncoding.EncodeToString(token)

// Store in session, verify on POST requests
func verifyCSRF(r *http.Request, sessionToken string) bool {
    formToken := r.FormValue("csrf_token")
    return subtle.ConstantTimeCompare([]byte(formToken), []byte(sessionToken)) == 1
}

Secure Headers

func securityHeaders(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.Header().Set("X-Content-Type-Options", "nosniff")
        w.Header().Set("X-Frame-Options", "DENY")
        w.Header().Set("X-XSS-Protection", "1; mode=block")
        w.Header().Set("Content-Security-Policy", "default-src 'self'")
        w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
        next.ServeHTTP(w, r)
    })
}

Rate Limiting

import "golang.org/x/time/rate"

type RateLimiter struct {
    limiters map[string]*rate.Limiter
    mu       sync.Mutex
}

func (rl *RateLimiter) Allow(ip string) bool {
    rl.mu.Lock()
    defer rl.mu.Unlock()
    
    limiter, exists := rl.limiters[ip]
    if !exists {
        limiter = rate.NewLimiter(rate.Limit(10), 20) // 10 req/sec, burst 20
        rl.limiters[ip] = limiter
    }
    
    return limiter.Allow()
}

Security Tools

# Static analysis
gosec ./...

# Dependency vulnerabilities
govulncheck ./...

# Secret scanning
gitleaks detect

# Fuzz testing
go test -fuzz=FuzzMyFunction

Troubleshooting

Anti-Patterns

Example Requests