Comprehensive security guidance modernization for Go 1.24+#108
Open
curphey wants to merge 1 commit intoOWASP:masterfrom
Open
Comprehensive security guidance modernization for Go 1.24+#108curphey wants to merge 1 commit intoOWASP:masterfrom
curphey wants to merge 1 commit intoOWASP:masterfrom
Conversation
Add 13 new security sections covering modern Go security practices: - HTTP Server Security (Slowloris protection, timeouts) - Rate Limiting (token bucket, per-client limiting) - Path Traversal Prevention (Go 1.24 os.Root, Zip Slip) - Command Injection Prevention (exec.Command, allowlists) - CORS Security (rs/cors configuration) - Context Timeouts (database, HTTP, goroutine management) - Secrets Management (Vault, AWS Secrets Manager, Kubernetes) - Container Security (scratch images, Kubernetes hardening) - Content Security Policy (nonces, strict-dynamic) - Passkeys/WebAuthn (FIDO2 passwordless authentication) - Security Tooling (govulncheck, gosec, fuzzing) - Claude Code Security Development (OWASP Go agent, hooks) - Security Scanning Integration (CI/CD, pre-commit) Enhance existing sections with modern patterns: - Input Validation: go-playground/validator examples - SQL Injection: complete CRUD, IN clause, ORDER BY allowlist - Cryptographic Practices: Go 1.22 ChaCha8Rand, Go 1.24 FIPS 140-3 - Password Management: Argon2id, NIST 800-63B guidelines - Session Management: JWT v5 migration, SameSite cookies - Error Handling: Go 1.13+ error wrapping with errors.Is/As - Logging: log/slog structured logging - CSRF: Gorilla alternatives after archive - Memory Management: race detection section Also adds CLAUDE.md for Claude Code guidance with project overview, build commands, structure, and git flow documentation. Updates align with OWASP Top 10 2021 and current Go best practices. Closes OWASP#95 (Gorilla toolkit status) Addresses OWASP#71 (code samples) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR brings the OWASP Go Secure Coding Practices Guide up to date with modern Go security practices (Go 1.22-1.24+). The guide's core content was written in 2017, and this update addresses the gaps identified in a forthcoming analysis of OWASP project currency.
Background
I'm Mark Curphey - I founded OWASP about 25 years ago and have been doing an analysis of OWASP projects to understand which ones developers should actually rely on. Go-SCP stood out as a project with great potential (5,200+ stars, strategic language coverage) but substantive content frozen in 2017. This PR is the put up or shut up part of that analysis.
This work was done in collaboration with Claude Code (Anthropic's AI coding assistant) as an experiment in using AI to modernize security documentation.
The full blog about what I did is https://crashoverride.com/blog/ai-security-guidance-vs-outdated-owasp-go-practices
Note: This is a recreation of PR #107 which was accidentally closed when the fork was deleted.
Changes
New Sections (13 files)
Enhanced Sections (18 files)
Addresses
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.5 noreply@anthropic.com