Web
Build a Link Preview Service in Go Without SSRF Holes
Build a link preview service in Go that fetches a URL and reads its Open Graph tags, with a dialer that blocks private addresses after DNS to stop SSRF.
17 min read
Topic
Security
Input you should not trust, crypto you should not roll yourself, TLS, secrets, dependency scanning and how Go code actually gets exploited.
APIs
Filtering and Sorting in Go APIs Without SQL Injection
Build filter and sort parameters for a Go API from an allowlist: bound values, mapped columns, escaped LIKE wildcards and a blind injection through ORDER BY.
13 min read
Web
Templ Forms Validation Errors and CSRF Tokens in Go
Build an accessible templ form in Go with errors beside each field, kept values, a redirect after success and CSRF protection from Go 1.25.
9 min read
APIs
Bearer Tokens and Refresh Flows in Go APIs Explained
Build short-lived JWT access tokens and rotating refresh tokens in Go: pinned verification, hashed storage, reuse detection and a concurrent refresh trap.
13 min read
Web
Expose Pprof on a Go Server Without Exposing It to Everyone
Serve net/http/pprof from a separate loopback listener with a token, avoid the DefaultServeMux trap, and fix the WriteTimeout error on CPU profiles.
9 min read
Web
TLS for a Go Server With Autocert and Lets Encrypt
Serve HTTPS from a Go program with autocert and Lets Encrypt, limit which hostnames may get certificates, persist the cache and handle port 80.
7 min read
APIs
API Keys in Go and How to Generate Hash and Rotate Them
Generate, store and rotate API keys in Go: a prefixed format with a checksum, SHA-256 storage, throttled last-used, overlap rotation and 85 ns rejection.
13 min read
Web
Render Markdown in Go With Goldmark Without XSS Holes
Render Markdown in Go with goldmark safely: what defaults block, what WithUnsafe lets through, and how to sanitize output with bluemonday for user content.
10 min read
APIs
Authentication for Go APIs With Keys Tokens and Sessions
Build Go API authentication with one Principal and three mechanisms: hashed API keys, signed bearer tokens and cookie sessions, with 401 versus 403 and CSRF.
19 min read
Web
Templ Mistakes With Escaping and Raw HTML in Components
Where templ escapes for you and where it does not: URLs, SafeURL, style strings, Raw, script data and event handlers, shown with real output and tests.
10 min read
Web
Build a Webhook Receiver in Go With Signature Checks
Build a webhook receiver in Go that checks an HMAC signature on the raw body, rejects stale and replayed events, answers fast and processes in the background.
15 min read
APIs
Request Validation in Go APIs Without Reflection Magic
Validate Go API requests with a small collector: JSON Pointer paths, nested fields, cross-field rules, rune-aware lengths and 340 ns for a valid order.
17 min read
Get new articles by email
We send one email when a new article is published. No spam.