google / go-safeweb

Secure-by-default HTTP servers in Go.

google/go-safeweb Issues

Can we integrate with gorilla/mux for path parameters support?
Updated 5 months ago2
collector plugin should pass request context
Updated 7 months ago
gofmt GitHub action seems broken
Closed a year ago2
Repair CI
Closed a year ago1
Test failure with upcoming Go 1.20 release
Closed 2 years ago3
Create a XSRF plugin that blocks all state-changing requests
Closed 2 years ago
Create adoption, migration and code structure documentation
Updated 2 years ago
Bump language version to 1.18
Updated 2 years ago
Uniform builtin plugins exemption structures to allow for allowlisting of packages.
Updated 2 years ago
Add report-to and general reporting group support to the CSP plugin
Updated 2 years ago
Create a keyless XSRF protection that allows for state-changing requests.
Closed 2 years ago1
Design and create a way to have a "safe buffer" that allows to cache responses in a safe way.
Updated 2 years ago
Support streaming responses
Updated 2 years ago
Create a template package with all boilerplate and all instructions needed to use the framework
Updated 2 years ago
Reassess the cors plugin
Updated 2 years ago
Create an integration test for the safehttp/defaults builder
Updated 2 years ago
Make Bancheck support "TestOnly" or similar mechanisms.
Updated 2 years ago
Muxes are not composable
Updated 3 years ago2
(*safehttp.Config).Mux() is not safe for concurrent use
Closed 3 years ago
Update the Security Vulnerabilities and Mitigations section to link to the specific GoDoc sections that provide the features
Updated 3 years ago
bancheck: Add documentation to doc.go
Closed 3 years ago1
Provide a way for the dispatcher to extract the request for the given flight
Closed 3 years ago2
Provide a StripPrefix utility
Closed 3 years ago
Remove the Map type
Updated 3 years ago
SetContext violates the context.Context contract
Closed 3 years ago2
Add an After stage to the interceptor flow
Updated 3 years ago
Provide a way to check if a ServeMuxConfig has a specific interceptor installed.
Closed 3 years ago2
Re-assess the one-config-per-interceptor hard limit
Closed 3 years ago2
Reserve characters for path parameters
Updated 3 years ago1
Support Interceptor Wrapping
Updated 3 years ago1
xsrfhtml: Support key rotation
Updated 3 years ago
Why is Handle signature taking (path, method, handler) instead of (method, path, handler)?
Closed 3 years ago1
Provide a "ServeTemplates" helper
Updated 3 years ago
Make sure that no two given configs apply to the same interceptor
Closed 3 years ago
reportingapi: Add an option to serialize it as a structured header.
Updated 3 years ago
Implement a ReportTo plugin
Closed 3 years ago
Move away from "ban" in favor of "restrict" in the language
Updated 3 years ago
fetchmetadata: switch to configs for exceptions
Closed 3 years ago
bancheck: Does it work for methods of concrete types?
Updated 3 years ago5
bancheck: Provide configurations
Updated 3 years ago
bancheck: Add tests for aliasing
Updated 3 years ago
Allow JS in static HTML files
Updated 3 years ago
Create a contributors guide
Updated 3 years ago
A linter for disallowing imports and function calls
Closed 3 years ago
Rename "Dispatcher"
Updated 3 years ago1
Make multipart forms resilient to path traversal attacks
Closed 3 years ago
Hide the Dispatcher from ServeMuxConfig
Closed 3 years ago
The defaults package should offer more configuration options
Updated 3 years ago
Add a way to use the defaults package with Angular
Updated 3 years ago
Add static hashes support to the csp plugin
Closed 3 years ago1