These examples progress from minimal to full-stack. Each is runnable from the repository root with plain go run.

​
securityhttp (flagship)

The fastest way to wire up sessions, CSRF, default-deny authorization, and a JSON login endpoint — five lines with securityhttp.NewHandler(...).
→ Full walkthrough

​
Basic HTTP Basic Auth

The minimal complete setup: in-memory users, a delegating password encoder, and middleware.BasicAuth protecting a couple of routes.
→ Full walkthrough

​
Authorization route rules

Adds route-rule authorization and a role hierarchy (ADMIN > STAFF > USER) on top of HTTP Basic Auth, with default-deny and 401-vs-403 exception translation.
→ Full walkthrough

​
Bearer-token resource server

A JWT-verifying resource server: HS256 tokens, scope → SCOPE_* authority mapping, and route rules gating /api/admin/** against the rest of /api/**.
→ Full walkthrough

​
Full web application

Server-side sessions, a session-backed CSRF synchronizer token, remember-me cookies, CORS, and the security-headers/anonymous middlewares — all in-memory, no external dependencies.
→ Full walkthrough

​
OAuth2 login

Wires a Google (OIDC) and a Zalo (plain OAuth2) registration plus a local “dev” provider stub, so the login flow runs end-to-end with no real credentials.
→ Full walkthrough

​
Framework integration (Gin, Echo, chi, gorilla/mux, Fiber)

The same app and the same security options on five different routers — one program each, in a separate Go module so the frameworks stay out of the library’s dependency graph.
→ Full walkthrough · Web Frameworks guide

​
Interactive playground

A self-contained demo of the full stack — form login, four OAuth2 providers (Google, GitHub, Facebook, Zalo, all backed by a local stub server), CSRF, and role-based authorization — with no external dependencies.
Open http://localhost:8080. → Full walkthrough