Go secureserver
Out-of-the-box, Go is a fully capable HTTP/HTTPS server. However, it is not configured correctly to avoid malicious clients, timeouts, or even simple SSL auto setup with LetsEncrypt.org.
This repository exists to help go developers launch a secure, simple HTTPS server.
This configuration blocks major attacks like:
- BEAST attack
- POODLE (SSLv3)
- POODLE (TLS)
- Heartbleed
- CRIME
- FUBAR
- OpenSSL CCS vulnerability (CVE-2014-0224)
- OpenSSL Padding Oracle vulnerability
Achieving forward secrecy and low server load are a focus.
Reading
- https://blog.bracebin.com/achieving-perfect-ssl-labs-score-with-go
- https://blog.gopheracademy.com/advent-2016/exposing-go-on-the-internet/
- https://blog.cloudflare.com/the-complete-guide-to-golang-net-http-timeouts/
- https://cipherli.st/
- https://wiki.mozilla.org/Security/Server_Side_TLS
Install
go get github.com/xeoncross/secureserver
Demo Server
You can quickly run a test HTTP/HTTPS server like so:
package main
import (
"github.com/xeoncross/secureserver"
)
func main() {
domain := "example.com"
HSTS := false // enable/disable HSTS
secureserver.RunHTTPRedirectServer()
secureserver.RunDemoHTTPSServer(domain, HSTS) // blocks
}
Usage
package main
import (
"github.com/xeoncross/secureserver"
)
func main() {
domain := "example.com"
secureserver.RunHTTPRedirectServer()
s := secureserver.GetHTTPSServer(domain)
mux := http.NewServeMux()
mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
w.Header().Add("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
w.Write([]byte("This is an example server on " + domain + ".\n"))
})
s.Handler = mux
log.Fatal(s.ListenAndServeTLS("", ""))
}
Todo
- Implement support for graceful shutdown
Contributions Required
To serve a source of information about current Go best-practices; pull requests, issues, and documentation are welcome.