Securing Your Go Web Application with HTTPS

Table of Contents

  1. Overview
  2. Prerequisites
  3. Setup
  4. Generating SSL Certificate
  5. Configuring HTTPS in Go
  6. Testing the HTTPS Server
  7. Conclusion

Overview

In this tutorial, we will learn how to secure a Go web application by enabling HTTPS. The Hypertext Transfer Protocol Secure (HTTPS) ensures secure communication between a client and a server by encrypting the data. By the end of this tutorial, you will be able to configure and test a Go web server to serve traffic over HTTPS, adding an extra layer of security to your application.

Prerequisites

Before starting this tutorial, you should have:

  • Basic knowledge of the Go programming language
  • Go installed on your machine
  • Understanding of web application development concepts
  • Familiarity with the command line

Setup

To get started, let’s set up a basic Go web server. Create a new directory for our project and navigate to it in the terminal:

mkdir mywebapp
cd mywebapp

Now, initialize a new Go module:

go mod init github.com/your-username/mywebapp

We have set up the basic project structure. Next, let’s install the required dependencies to handle HTTP requests and responses:

go get github.com/gorilla/mux

This will download and install the Gorilla Mux package, which provides an improved router for handling HTTP requests in Go.

Generating SSL Certificate

To enable HTTPS, we need an SSL/TLS certificate. For development purposes, we can generate a self-signed certificate. However, for production, you should obtain a valid certificate from a certificate authority.

Here, we will generate a self-signed certificate using OpenSSL. If you don’t have OpenSSL installed, you can install it by following the appropriate instructions for your operating system.

Open a terminal window and execute the following command to generate a private key and a self-signed certificate:

openssl req -x509 -newkey rsa:4096 -nodes -keyout key.pem -out cert.pem -days 365

You will be prompted to enter details such as the country, organization, common name, etc. Feel free to provide any values for testing purposes.

We now have the SSL certificate and private key (cert.pem and key.pem respectively) that we can use to configure our Go web server.

Configuring HTTPS in Go

Now let’s create a simple Go web server and configure it to serve over HTTPS. Create a new file called main.go in your project directory:

package main

import (
	"log"
	"net/http"
)

func main() {
	router := http.NewServeMux()
	router.HandleFunc("/", helloHandler)

	// Path to the SSL certificate and private key files
	certFile := "cert.pem"
	keyFile := "key.pem"

	err := http.ListenAndServeTLS(":8443", certFile, keyFile, router)
	if err != nil {
		log.Fatal("Failed to start server: ", err)
	}
}

func helloHandler(w http.ResponseWriter, r *http.Request) {
	w.Write([]byte("Hello, HTTPS!"))
}

In this code snippet, we import the necessary packages (log and net/http) and define our main function. Inside the main function, we create a new router using http.NewServeMux() and register a handler function for the root path (“/”) using router.HandleFunc().

Next, we specify the paths to our SSL certificate and private key files. Ensure that the paths are correct and match your certificate and key files.

Finally, we start the HTTPS server by calling http.ListenAndServeTLS() and passing the desired port (:8443), the certificate file, key file, and the router.

Testing the HTTPS Server

To test our HTTPS server, run the following command in the terminal:

go run main.go

You should see the output:

2021/08/01 15:27:59 http: TLS handshake error from 127.0.0.1:62715: EOF

This error occurs because we are using a self-signed certificate. To access the server in a web browser, we need to trust the certificate manually. Open your preferred web browser and visit https://localhost:8443. You will likely see a warning message indicating that the certificate is not trusted. Allow the exception and proceed to the website.

On the webpage, you should see the text “Hello, HTTPS!” which indicates that our server is running and serving traffic over HTTPS.

Congratulations! You have successfully secured your Go web application with HTTPS.

Conclusion

In this tutorial, we learned how to secure a Go web application by enabling HTTPS. We covered the prerequisites, set up a basic Go web server, generated a self-signed SSL certificate, configured the Go web server to serve over HTTPS, and tested the HTTPS server.

By using HTTPS, you can ensure that the communication between your web application and the client is secure and encrypted. Although self-signed certificates are suitable for development and testing purposes, in production, it is recommended to obtain a valid certificate from a trusted certificate authority.

Remember to always prioritize the security of your web applications, especially when handling sensitive user data. Stay up-to-date with the latest security best practices and ensure your application follows them.

Happy coding!

Published:

Related Articles