TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Exposing Go Services to the Internet

1 post · Dec 2016

What this trail covers

This post details how to securely expose Go services to the internet by hardening the `crypto/tls` and `net/http` stacks. It covers TLS configuration, timeouts, HTTP/2 considerations, TCP Keep-Alives, and best practices for using `ServeMux` and logging. The post emphasizes the importance of upgrading to Go 1.8 for critical bug fixes and performance improvements in TLS and HTTP/2 handling.

All Cloudflare trails
  1. So you want to expose Go on the InternetThis post provides specific guidance on configuring Go's `crypto/tls` and `net/http` packages for production internet exposure. It details recommended `tls.Config` settings for security and performance, including `PreferServerCipherSuites`, `CurvePreferences`, `MinVersion`, and `CipherSuites`, while warning about the Lucky13 attack on CBC cipher suites. It also explains the critical role of `ReadTimeout`, `WriteTimeout`, and `IdleTimeout` in resource control and preventing denial-of-service attacks, highlighting differences in their application for HTTP/1.1 and HTTP/2, and the importance of upgrading to Go 1.8. Best practices for avoiding global `http.DefaultServeMux` and managing `Server.ErrorLog` are also covered.