go-security - go-security

Security for net/http, batteries included. go-security gopher mascot holding a padlock

Get Started

Module Reference

View on GitHub

Secure by default

Security headers, CSRF, session fixation protection, default-deny authorization, and Secure+HttpOnly+SameSite=Lax cookies — all on with zero configuration.

net/http-native

Pure middleware functions — no reflection, no DI container, no framework lock-in. Any router works. Benchmarks show <1 µs overhead per request.

Zero extra dependencies

Standard library + golang.org/x/crypto only. Redis stores live in a separate optional module so your go.mod stays clean.

Full authentication stack

Password (bcrypt/argon2), API key, HMAC, bearer JWT, OAuth2 code flow with PKCE, OIDC, magic link, passkey, TOTP — all behind one Manager interface.

Algorithm-tagged password hashes

DelegatingEncoder stores each hash with an {id} algorithm prefix, so you can rotate algorithms per row and adopt it over an existing password column without re-hashing.

All four OAuth2 providers built-in

Google (OIDC), GitHub, Facebook, and Zalo provider presets with correct endpoints, scopes, subject attributes, and quirks pre-configured.

The 5-line integration

handler, err := securityhttp.NewHandler(app,
    securityhttp.WithSessionStore(store, users),
    securityhttp.WithLogin("/login", manager),
    securityhttp.WithAuthorize(authz.Routes(
        authz.Match("/admin/**").HasRole("ADMIN"),
        authz.AnyRequest().Authenticated(),
    )),
)

Security headers, CSRF protection, session cookies, and authorization default-deny come for free. NewHandler returns an http.Handler — drop it in.

Feature coverage

Feature	go-security
Security context	`core` on `context.Context`
Authentication manager	`authn.Manager`
DAO auth provider	`authn.PasswordProvider`
Password encoding	`crypto/password`
HTTP security DSL	`securityhttp.NewHandler()`
Route authorization	`authz.Routes()`
Session management	`web/session`
CSRF	`web/csrf` (synchronizer + double-submit)
CORS / security headers	`web/cors`, `web/middleware`
Form login / logout	`web/auth`
Remember-me	`web/rememberme`
OAuth2 login	`oauth2` + PKCE
JWT / resource server	`jwt` + `web/resource`
Role hierarchy	`authz.RoleHierarchy`
Rate limiting	`ratelimit` (token bucket + fixed window)
Account lockout	`lockout`
Audit events	`core/event`
Observability	`observe` (bridge to your registry)