guardrailsio / awesome-golang-security

Awesome Golang Security resources 🕶🔐

A curated list of awesome golang Security related resources.

List inspired by the awesome list thing.

Supported by: GuardRails.io

Contents

• Tools
• Educational
• Other
• Contributing

Tools

Web Framework Hardening

• nosurf - CSRF protection middleware for Go.
• gorilla/csrf - Provides Cross-Site Request Forgery (CSRF) prevention middleware for Go web applications & services.
• gorilla/securecookie - Encodes and decodes authenticated and optionally encrypted cookie values for Go web applications.
• secure - Secure is an HTTP middleware for Go that facilitates most of your security needs for web applications.
• unindexed - A drop-in replacement for http.Dir which disables directory indexing.
• beego-security-headers - beego framework filter for easy security headers management.

Libraries

• paseto - Platform-Agnostic Security Tokens implementation in GO (Golang).
• hsts - Go HTTP Strict Transport Security library.
• jwt-go - Golang implementation of JSON Web Tokens (JWT).
• httprobe - Take a list of domains and probe for working HTTP and HTTPS servers.

Static Code Analysis

• safesql - Static analysis tool for Golang that protects against SQL injections. It does not seem to be actively maintained at the moment.
• gosec - Inspects source code for security problems by scanning the Go AST and matching it with a set of rules. Comes bundled in a Docker container securego/gosec.
• gometalinter - Concurrently runs most of the existing go linters and normalizes their output.
• CodeQL - A tool that lets you query your code like data, in order to find vulnerabilities and bugs. See also LGTM.com for pull request integration and running queries in the cloud.
• ChainJacking - Find which of your Go lang direct GitHub dependencies is susceptible to ChainJacking attack.

Vulnerabilities and Security Advisories

• golang-announce - The golang release mailing list. Language-specific security issues are announced here.
• GoCenter Security and JFrog VSCode Extension for Go - Free vulnerability data around Go Modules
• snyk Vulnerability DB - Commercial but free listing of known vulnerabilities in libraries.
• Common Vulnerabilities and Exposures - Vulnerabilities that were assigned a CVE. Covers the language and packages.
• National Vulnerability Database - Golang known vulnerabilities in the National Vulnerability Database.

Private Key Infrastructure

• CloudFlare SSL - CFSSL is CloudFlare's PKI/TLS swiss army knife. It is both a command line tool and an HTTP API server for signing, verifying, and bundling TLS certificates.

Educational

Hacking Playground

• govwa - A vulnerable golang application including the most common vulnerabilities found in web applications today.
• Lambhack - A very vulnerable serverless application in AWS Lambda.

Articles, Guides & Talks

• gosea - Go Secure Example Application (GOSEA).
• Go - Secure Coding Practices by OWASP - [PDF] Talk given by Sulhaedir at the OWASP Jakarta meetup.
• OWASP Go - Secure Coding Practices by Checkmarx - Go programming language secure coding practices guide.
• Memory Security in golang - Handling data securely in memory.
• A Go Programmer's Guide to Secure Connections - [Video] GopherCon 2018, Liz Rice.
• golang-tls - Simple Golang HTTPS/TLS Examples.
• Hacking with Go - Hacking with Go for security professionals.
• ReDoS in Go by Checkmarx - Diving Deep into Regular Expression Denial of Service (ReDoS) in Go.
• Attacking Go: A detailed description on Security assessment techniques for Go projects.

Other

Reporting Bugs

• Go Security Policy

Contributing

Found an awesome project, package, article, or another type of resources related to golang Security? Submit a pull request! Just follow the guidelines. Thank you!

License

awesome-golang-security's Issues

HashiCorp?

For instance, you could add Consul to the PKI part.

Keeping Awesome lists together

Imo it would be a good idea to add this list to the already existing awesomelist (https://github.com/sindresorhus/awesome you also listed) to not fragment the information.

Suggestions for the list

Hi,
Some suggestions for the curated list:

For the Web Framework Hardening:

• beego-security-headers - beego framework filter for easy security headers management.

For the Articles, Guides & Talks:

• ReDoS in Go by Checkmarx - Diving Deep into Regular Expression Denial of Service (ReDoS) in Go

Thanks for the great list.

What form does guardrails.io "support" take?

Hi, someone linked guardrailsio/awesome-golang-security to gophers slack #security. As I typically do when I hear of a new "security thing", I'm briefly assessing its threat model.

A couple threats I've considered here:

• this repo could contain intentionally poisoned links
• a linked project could be clean today but intentionally poison a future release.

(Again I'm just imagining possible threats; I don't have reason to believe those or other attacks are happening; I'm not accusing the contributors or linked projects.)

I would have dropped it at this point, but these bits piqued my interest:

Supported by: [GuardRails.io](https://www.guardrails.io)

[GuardRails](https://www.guardrails.io) - A GitHub App that gives you instant security feedback in your Pull Requests.

Send me a pull request...

say _hi_ on [Twitter](https://twitter.com/pxlpnk)

@pxlpnk's linked github and twitter don't mention guardrails.io.
Does guardrails.io now maintain this repo?
Is there any "support" provided by guardrails.io beyond maintaining the repo?
If not, consider updating the copy:

- Supported by: GuardRails.io
+ Maintained by: GuardRails.io
- Send me a pull request...
+ Submit a pull request...
- say _hi_ on [Twitter](https://twitter.com/pxlpnk)