Security with Go

Adding secure HTTP headers

Taking advantage of the Negroni package, we can easily create our own middleware to inject a set of HTTP headers to help improve security. You will need to evaluate each header to see whether it makes sense for your application. In addition, not every browser supports every one of these headers. This is a good baseline to begin with and modify to suit your needs.

The following headers are used in this example:

Header	Description
Content-Security-Policy	This defines what scripts or remote hosts are trusted and able to provide executable JavaScript
X-Frame-Options	This defines whether or not frames and iframes can be used and which domains are allowed to appear in frames
X-XSS-Protection