README
¶
Go secureserver
Out-of-the-box, Go is a fully capable HTTP/HTTPS server. However, it is not configured correctly to avoid malicious clients, timeouts, or even simple SSL auto setup with LetsEncrypt.org.
This repository exists to help go developers launch a secure, simple HTTPS server.
This configuration blocks major attacks like:
- BEAST attack
- POODLE (SSLv3)
- POODLE (TLS)
- Heartbleed
- CRIME
- FUBAR
- OpenSSL CCS vulnerability (CVE-2014-0224)
- OpenSSL Padding Oracle vulnerability
Achieving forward secrecy and low server load are a focus.
Reading
- https://blog.bracebin.com/achieving-perfect-ssl-labs-score-with-go
- https://blog.gopheracademy.com/advent-2016/exposing-go-on-the-internet/
- https://blog.cloudflare.com/the-complete-guide-to-golang-net-http-timeouts/
- https://cipherli.st/
- https://wiki.mozilla.org/Security/Server_Side_TLS
Install
go get github.com/xeoncross/secureserver
Demo Server
You can quickly run a test HTTP/HTTPS server like so:
package main
import (
"github.com/xeoncross/secureserver"
)
func main() {
domain := "example.com"
HSTS := false // enable/disable HSTS
secureserver.RunHTTPRedirectServer()
secureserver.RunDemoHTTPSServer(domain, HSTS) // blocks
}
Usage
package main
import (
"github.com/xeoncross/secureserver"
)
func main() {
domain := "example.com"
secureserver.RunHTTPRedirectServer()
s := secureserver.GetHTTPSServer(domain)
mux := http.NewServeMux()
mux.HandleFunc("/", func(w http.ResponseWriter, req *http.Request) {
w.Header().Add("Strict-Transport-Security", "max-age=63072000; includeSubDomains")
w.Write([]byte("This is an example server on " + domain + ".\n"))
})
s.Handler = mux
log.Fatal(s.ListenAndServeTLS("", ""))
}
Todo
- Implement support for graceful shutdown
Contributions Required
To serve a source of information about current Go best-practices; pull requests, issues, and documentation are welcome.
Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var CipherSuites = []uint16{ tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, tls.TLS_RSA_WITH_AES_256_GCM_SHA384, tls.TLS_RSA_WITH_AES_128_GCM_SHA256, }
CipherSuites without known attacks or extreme CPU usage https://golang.org/src/crypto/tls/cipher_suites.go#L75
var Curves = []tls.CurveID{ tls.CurveP256, }
Curves without known attacks or extreme CPU usage https://golang.org/src/crypto/tls/common.go#L542
Functions ¶
func GetCertificate ¶
GetCertificate using autocert
func GetHTTPSServer ¶
GetHTTPSServer fully secured
func RunDemoHTTPSServer ¶
RunDemoHTTPSServer to demo a working example
func RunHTTPRedirectServer ¶
RunHTTPRedirectServer to send all HTTP traffic to HTTPS
Types ¶
This section is empty.
Source Files