{"repo":"unrolled/secure","free":true,"listed":false,"github":"https://github.com/unrolled/secure","clone":"git clone https://github.com/unrolled/secure.git","description":"HTTP middleware for Go that facilitates some quick security wins.","language":"Go","stars":2353,"topics":["golang","go","middleware","security"],"license":"MIT","category":"security-tools","readme_excerpt":"Secure Secure is an HTTP middleware for Go that facilitates some quick security wins. It's a standard net/http Handler, and can be used with many frameworks or directly with Go's net/http package. Usage go // main.go package main import ( \"net/http\" \"github.com/unrolled/secure\" ) var myHandler = http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Write([]byte(\"hello world\")) }) func main() { secureMiddleware := secure.New(secure.Options{ AllowedHosts: []string{\"example\\\\.com\", \". \\\\.example\\\\.com\"}, AllowedHostsAreRegex: true, HostsProxyHeaders: []string{\"X-Forwarded-Host\"}, SSLRedirect: true, SSLHost: \"ssl.example.com\", SSLProxyHeaders: map[string]string{\"X-Forwarded-Proto\": \"https\"}, STSSeconds: 31536000, STSIncludeSubdomains: true, STSPreload: true, FrameDeny: true, ContentTypeNosniff: true, BrowserXssFilter: true, ContentSecurityPolicy: \"script-src $NONCE\", }) app := secureMiddleware.Handler(myHandler) http.ListenAndServe(\"127.0.0.1:3000\", app) } Be sure to include the Secure middleware as close to the top (beginning) as possible (but after logging and recovery). It's best to do the allowed hosts and SSL check before anything else. The above example will only allow requests with a host name of 'example.com', or 'ssl.example.com'. Also if the request is not HTTPS, it will be redirected to HTTPS with the host name of 'ssl.example.com'. Once those requirements are satisfied, it will add the following headers: go Strict-Transport-Security: 31536000; includeSubdom","default_branch":null,"files":null,"tree":[],"storefront":"/r/unrolled","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/unrolled/secure/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}