ssgo

README

Safe&Secure Go Development

Course source code written in Golang.

The course aims to provide best practices for developing secure server applications based on prevention of vulnerabilities from the OWASP 2021 Top Ten.

Prerequisites:

• The Go Programming Language
• Go tour

References:

• The Open Web Application Security Project® (OWASP)
• OWASP Top Ten
• A01:2021 – Broken Access Control
• A02:2021 – Cryptographic Failures
• A03:2021 – Injection
• A04:2021 – Insecure Design
• A05:2021 – Security Misconfiguration
• A06:2021 – Vulnerable and Outdated Components
• A07:2021 – Identification and Authentication Failures
• A08:2021 – Software and Data Integrity Failures
• A09:2021 – Security Logging and Monitoring Failures
• A10:2021 – Server-Side Request Forgery (SSRF)

Documentation

Index

• Constants
• Variables
• func NewRegisteredClaims(userID uuid.UUID, issuedAt time.Time, ttl time.Duration) jwt.RegisteredClaims
• func NewSignedJWT(secret []byte, userID uuid.UUID, permissions map[string][]Permission) (string, error)
• func RunTestServer(t *testing.T, ctx context.Context, opts ...ServerOpt) (baseURL string, waitFunc func())
• type Claims
  • func ClaimsFromJWT(rawToken string, secret []byte) (*Claims, error)
  • func NewClaims(userID uuid.UUID, permissions map[string][]Permission) Claims
• type Hacker
• type Permission
• type Server
  • func NewServer(port uint, opts ...ServerOpt) Server
  • func (s Server) Handler() http.Handler
  • func (s *Server) Run() error
  • func (s *Server) Shutdown() error
• type ServerOpt
  • func ServerWithRoute(route ServerRoute) ServerOpt
• type ServerRoute

Constants

const (
	AuthorizationHeaderKey = "Authorization"

	DefaultJWTTimeToLive = time.Hour
)

Variables

var (
	HackerLogger = log.New(os.Stderr, "[HACKER] ", log.Ldate|log.Ltime|log.Lmsgprefix)
	ServerLogger = log.New(os.Stderr, "[SERVER] ", log.Ldate|log.Ltime|log.Lmsgprefix)
)

Functions

func NewRegisteredClaims

func NewRegisteredClaims(userID uuid.UUID, issuedAt time.Time, ttl time.Duration) jwt.RegisteredClaims

NewRegisteredClaims creates default jwt claims with predefined constraints

func NewSignedJWT

func NewSignedJWT(secret []byte, userID uuid.UUID, permissions map[string][]Permission) (string, error)

NewSignedJWT returns raw jwt token signed

func RunTestServer

func RunTestServer(t *testing.T, ctx context.Context, opts ...ServerOpt) (baseURL string, waitFunc func())

RunTestServer listens http on incrementing port for testing purposes

Types

type Claims

type Claims struct {
	jwt.RegisteredClaims

	Permissions map[string][]Permission `json:"permissions"`
}

Claims to store permissions per entity

func ClaimsFromJWT

func ClaimsFromJWT(rawToken string, secret []byte) (*Claims, error)

ClaimsFromJWT parses raw jwt token and returns Claims

func NewClaims

func NewClaims(userID uuid.UUID, permissions map[string][]Permission) Claims

NewClaims constructor

type Hacker

type Hacker interface {
	Attack() error
}

Hacker set of operations

type Permission

type Permission string

Permission for entity

const (
	PermissionWrite Permission = "write"
	PermissionRead  Permission = "read"
)

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server abstraction for an HTTP protocol

func NewServer

func NewServer(port uint, opts ...ServerOpt) Server

NewServer constructor

func (Server) Handler

func (s Server) Handler() http.Handler

Handler mounts multiple ServerRoute and handles HTTP requests

func (*Server) Run

func (s *Server) Run() error

Run HTTP Server

func (*Server) Shutdown

func (s *Server) Shutdown() error

Shutdown HTTP Server

type ServerOpt

type ServerOpt func(*Server)

ServerOpt to enhance Server

func ServerWithRoute

func ServerWithRoute(route ServerRoute) ServerOpt

ServerWithRoute mounts routes at a root Server.Handler

type ServerRoute

type ServerRoute struct {
	Pattern string
	Handler http.Handler
}

ServerRoute that can be registered via ServerWithRoute