How to Secure Your Go Application

Hello, friends!

It is very important to think about making applications reliable and secure. Go is a language that is known for its simplicity and performance. But no language is secure by itself and you need to take care of it yourself.

In this article, we will share with you methods that will help you make your Go applications impenetrable fortresses.

Validating user input

Validating user input is one of the basic actions on the task list. The program should consider the input data as potentially malicious.

SQL injections, XSS attacks and other similar threats arise due to thoughtless actions in data processing.

To validate input data, you can use the library Go Validator, which allows you to validate structures using validation tags:

package main

import (
    "fmt"
    "github.com/go-playground/validator"
)

type User struct {
    Email string `validate:"required,email"`
    Age   int    `validate:"gte=18"`
}

func main() {
    validate := validator.New()

    user := &User{
        Email: "invalid email",
        Age:   16,
    }

    err := validate.Struct(user)
    if err != nil {
        fmt.Println("Validation failed:", err)
    } else {
        fmt.Println("Validation passed!")
    }
}

• Email: Uses a validator to check the email format.

• Age: Checks that the user is at least 18 years old.

This step can already avoid most problems at an early stage, protecting the application from incorrect input.

Secure Configuration Management

One of the main vulnerabilities of applications is the leakage of sensitive information such as passwords, API keys, and other configuration data. Go has several ways to manage configuration, and one of them is environment variables.

This is one of the most popular approaches to keeping sensitive data outside of the source code.

Example:

package main

import (
    "fmt"
    "os"
)

func main() {
    apiKey := os.Getenv("API_KEY")
    if apiKey == "" {
        fmt.Println("API key not set")
        return
    }
    fmt.Println("API key:", apiKey)
}

• os.GetEnv: Gets the value of an environment variable.

• API key not set: Checks if an environment variable is set and prevents the application from running with incorrect settings.

Use .env files to store configurations that should not be included in the version control system, as well as hide confidential data.

Authentication and Authorization

Without strong authentication and authorization, your application becomes an open door for attackers. In Go, you can use packages such as jwt-go And gorilla/sessionsfor managing sessions and tokens.

JSON Web Tokens

JWT is a way to transfer secure data between two parties in the form of JSON objects.

Example:

package main

import (
    "fmt"
    "github.com/dgrijalva/jwt-go"
    "time"
)

var mySigningKey = []byte("secret")

func GenerateJWT() (string, error) {
    token := jwt.New(jwt.SigningMethodHS256)
    claims := token.Claims.(jwt.MapClaims)
    claims["authorized"] = true
    claims["user"] = "user1"
    claims["exp"] = time.Now().Add(time.Minute * 30).Unix()

    tokenString, err := token.SignedString(mySigningKey)
    if err != nil {
        return "", err
    }

    return tokenString, nil
}

func main() {
    token, err := GenerateJWT()
    if err != nil {
        fmt.Println("Error generating token:", err)
        return
    }

    fmt.Println("Generated Token:", token)
}

• jwt.new: Creates a new JWT token.

• claims[“exp”]: Sets the token lifetime so that it automatically expires after 30 minutes.

Data encryption

Storing and transmitting data encrypted is an integral part of security. Go has a librarycryptowhich allows you to encrypt and decrypt data.

Example of symmetric encryption:

package main

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "encoding/hex"
    "fmt"
    "io"
)

func encrypt(text, key string) (string, error) {
    block, err := aes.NewCipher([]byte(key))
    if err != nil {
        return "", err
    }

    ciphertext := make([]byte, aes.BlockSize+len(text))
    iv := ciphertext[:aes.BlockSize]
    if _, err := io.ReadFull(rand.Reader, iv); err != nil {
        return "", err
    }

    stream := cipher.NewCFBEncrypter(block, iv)
    stream.XORKeyStream(ciphertext[aes.BlockSize:], []byte(text))

    return hex.EncodeToString(ciphertext), nil
}

func main() {
    text := "Hello, world!"
    key := "mysecretpasswordmysecretpassword" // 32 bytes

    encrypted, err := encrypt(text, key)
    if err != nil {
        fmt.Println("Error encrypting:", err)
        return
    }

    fmt.Println("Encrypted:", encrypted)
}

• aes.newcipher: Creates a new AES cipher block.

• cipher.NewCFBEncrypter: Creates a new cipher for symmetric encryption.

Dependency Management

The libraries you use may contain vulnerabilities that will affect the application itself. Go has excellent tools for managing dependencies – Go Modules.

Modules must be included to track and manage dependencies:

go mod init myapp
go get github.com/some/package

Update dependencies regularly: keep up to date with new library versions.

Use security analysis tools: example – Dependablebot..

Security is not a set of specific tools, but rather a process of continuous improvement and adaptation to new challenges.

If you have your own security tips or questions, share them in the comments. We'll be happy to discuss and share experiences!

In conclusion, we remind you about open lessons:

• August 14: “The connection between DR and HA in modern architectural solutions.” Explore the relationship between Disaster Recovery (DR) and High Availability (HA) in modern systems. Sign up

• August 20: «“Models of interservice interaction”. Explore different models of interaction between microservices and choose the best approach for your project. Sign up