APIs
Webhook Design for Go APIs That Customers Can Trust
Design webhooks customers can trust in Go: an event envelope, per-endpoint API versions, filters, secret rotation, auto-disable, replay and signing.
21 min read
Golang Hacks for Developers
Practical Go tips, patterns and recipes for developers who ship Go.
Pick a topicnode
> learn("basics")
> learn("concurrency")
Browse by topic
Find articles on the subject you are working with.
Basics
Types, slices, maps, structs and interfaces, and the small decisions that make Go code read like Go instead of Java with different braces.
Concurrency
Goroutines are cheap to start and expensive to get wrong. Channels, mutexes, context and the leaks and deadlocks waiting for anyone who skips the details.
Web
Servers, handlers, middleware, templates, cookies and sessions on net/http, plus the parts of a real website the tutorials leave out.
APIs
Designing JSON, REST and gRPC interfaces that other people have to live with: versioning, pagination, validation, errors and clients.
Testing
Table-driven tests, fakes over mocks, fuzzing, benchmarks and the habits that make a suite worth running on every save.
Databases
Talking to Postgres, MySQL, SQLite, Redis and friends without leaking connections, hand-building queries or fighting your migrations.
Performance
Profile first, then change something. pprof, allocations, the garbage collector, escape analysis and benchmarks that hold up in production.
Generics
Type parameters, constraints and iterators, and the honest answer to whether this particular function needed them at all.
DevOps
Getting a Go binary out the door and keeping it alive: containers, cross-compiling, CI pipelines, systemd, releases and rollbacks.
Security
Input you should not trust, crypto you should not roll yourself, TLS, secrets, dependency scanning and how Go code actually gets exploited.
Standard Library
The batteries that ship with Go. Check here before you add a dependency, because the answer is often already in the box.
Tooling
The go command, vet, linters, formatters, code generation, editors and the Git habits that keep a repository tidy.
Latest
Latest articles
The newest articles on the site.
Web
Build a Link Preview Service in Go Without SSRF Holes
Build a link preview service in Go that fetches a URL and reads its Open Graph tags, with a dialer that blocks private addresses after DNS to stop SSRF.
17 min read
APIs
Filtering and Sorting in Go APIs Without SQL Injection
Build filter and sort parameters for a Go API from an allowlist: bound values, mapped columns, escaped LIKE wildcards and a blind injection through ORDER BY.
13 min read
Web
Redirects in Go and the Right Status Code to Use for Each
Pick between 301, 302, 303, 307 and 308 in Go with http.Redirect, see which keep the method and body, and avoid open redirects from a query value.
4 min read
Web
Common Go Web Server Errors and What They Really Mean
Reproduce the errors Go HTTP servers and clients print, from address already in use to HTTP response to HTTPS client, and see what each message means.
11 min read
APIs
OpenAPI for Go Services Generated From Code or From Spec
Compare code-first and spec-first OpenAPI in Go with working code: huma generating the spec from types, and kin-openapi catching bad requests and drift.
11 min read
Guides
Step-by-step guides
Complete walkthroughs with tested code and real output.
Popular
Most read
The articles readers open most often.
Tools
Free developer tools
Format JSON, decode JWTs, test regex and more. Everything runs in your browser.
Standard Library
JSON Formatter and Validator
Pretty-print, minify and validate JSON, with the line and column of the first error. Sort keys to make two payloads comparable.
Open the toolSecurityJWT Decoder
Paste a JSON Web Token to read its header and payload, with exp, iat and nbf converted to dates. Nothing is sent anywhere.
Open the toolStandard LibraryRegex Tester
Test a JavaScript regular expression against sample text: every match, its position, numbered and named groups, and a live replace.
Open the toolToolingCron Expression Explainer
Paste a crontab schedule to see what each field means and the next eight times it will run, before it goes to production.
Open the toolStandard LibraryLaravel APP_KEY and Secret Generator
Generate a Laravel APP_KEY in the base64: format, or a hex token, a URL-safe token or a password, from a secure random source.
Open the toolWebBase64 Encoder and Decoder
Encode text to Base64 or decode it back, with UTF-8 handled correctly and an option for the URL-safe alphabet used in JWTs.
Open the toolGet new articles by email
We send one email when a new article is published. No spam.