Hardening HTTP Services

The defaults are not production-ready

http.ListenAndServe(":8080", mux) works, but the zero-value server has no timeouts and no body limits — both are denial-of-service waiting to happen. Hardening layers protections on top:

graph TD
REQ["request"] --> TO["timeouts<br/>(no Slowloris)"]
TO --> RL["rate limit<br/>(no flooding)"]
RL --> BL["body limit<br/>(no memory DoS)"]
BL --> REC["panic recovery<br/>(stay up)"]
REC --> HDR["security headers<br/>(browser enforces)"]
HDR --> H["your handler"]

Server timeouts and body limits

Always construct an explicit http.Server with timeouts, and bound request bodies (fenced — needs a listening socket, but it’s the core config):

srv := &http.Server{
	Addr:              ":8443",
	Handler:           mux,
	ReadHeaderTimeout: 5 * time.Second,  // defeats Slowloris
	ReadTimeout:       15 * time.Second,
	WriteTimeout:      15 * time.Second,
	IdleTimeout:       60 * time.Second,
	MaxHeaderBytes:    1 << 20,          // 1 MB of headers max
}

// Per-handler body cap: refuse bodies larger than 1 MB.
func handler(w http.ResponseWriter, r *http.Request) {
	r.Body = http.MaxBytesReader(w, r.Body, 1<<20)
	// ... decode r.Body; reads past the cap fail with a 413.
}

Without these, a slow client holds connections open forever and a large body exhausts memory — both trivial to exploit, both fixed in a few lines.

See it: a hardening middleware chain

Middleware composes cleanly in Go. This runs here using httptest (no real socket): a chain that recovers from panics, adds security headers, and still serves a normal request — proving one handler panic becomes a 500 instead of a crash:

package main

import (
"fmt"
"net/http"
"net/http/httptest"
)

// recoverMW turns a handler panic into a 500 instead of a process crash.
func recoverMW(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	defer func() {
		if err := recover(); err != nil {
			http.Error(w, "internal error", http.StatusInternalServerError)
		}
	}()
	next.ServeHTTP(w, r)
})
}

// securityHeaders adds defense-in-depth headers the browser enforces.
func securityHeaders(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("X-Content-Type-Options", "nosniff")
	w.Header().Set("Content-Security-Policy", "default-src 'self'")
	w.Header().Set("Strict-Transport-Security", "max-age=63072000")
	next.ServeHTTP(w, r)
})
}

func main() {
mux := http.NewServeMux()
mux.HandleFunc("/ok", func(w http.ResponseWriter, r *http.Request) {
	fmt.Fprint(w, "hello")
})
mux.HandleFunc("/boom", func(w http.ResponseWriter, r *http.Request) {
	panic("handler blew up") // simulated bug / attack trigger
})

// Wrap the mux: recover(outer) -> securityHeaders -> mux.
app := recoverMW(securityHeaders(mux))

for _, path := range []string{"/ok", "/boom"} {
	rec := httptest.NewRecorder()
	app.ServeHTTP(rec, httptest.NewRequest("GET", path, nil))
	fmt.Printf("%-6s -> %d  CSP=%q\n", path, rec.Code, rec.Header().Get("Content-Security-Policy"))
}
fmt.Println("server still running after the panic ✓")
}

/boom returns 500 instead of crashing the process, and every response carries the security headers. In production you’d add rate-limiting middleware (a token bucket keyed per client) and CSRF protection for state-changing form posts.

Graceful shutdown

Don’t hard-kill a server mid-request. srv.Shutdown(ctx) stops accepting new connections and lets in-flight requests finish, so rolling deploys don’t drop traffic:

ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
defer stop()
go srv.ListenAndServe()
<-ctx.Done() // wait for SIGINT/SIGTERM
shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
srv.Shutdown(shutdownCtx) // drain active requests, then exit

See also

• Input validation & injection — the per-request defenses inside the handler.
• Authentication & authorization — auth middleware in the same chain.
• TLS & PKI — serving the hardened server over HTTPS.
• Web security & HTTP servers (web track) — middleware and headers in depth.

Next: securing everything your code pulls in — supply-chain security.

Related topics