go-security

🔒 Go 安全实践和最佳实践

⚠️ 执行原则

MUST 遵循以下Go安全开发准则：

• MUST 验证所有输入数据
• NEVER 在代码中硬编码密钥和凭据
• ALWAYS 使用HTTPS和安全通信
• DO NOT 忽略依赖的安全漏洞
• MUST 实施适当的认证和授权
• ALWAYS 记录安全相关事件

JWT 认证实现

        NotBefore: jwt.NewNumericDate(time.Now()),
        Issuer:    "your-app",
    },
}

token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
return token.SignedString(j.secretKey)

}

func (j *JWTManager) ValidateToken(tokenString string) (*Claims, error) { token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) { if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok { return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"]) } return j.secretKey, nil })

if err != nil {
    return nil, err
}

if claims, ok := token.Claims.(*Claims); ok && token.Valid {
    return claims, nil
}

return nil, errors.New("invalid token")

}

## 📊 最佳实践

### 错误处理模式
```go
// ✅ 推荐：自定义错误类型
type Error struct {
    Code    string `json:"code"`
    Message string `json:"message"`
    Details string `json:"details,omitempty"`
}

func (e *Error) Error() string {
    return fmt.Sprintf("[%s] %s", e.Code, e.Message)
}

func NewError(code, message string) *Error {
    return &Error{
        Code:    code,
        Message: message,
    }
}

// 预定义错误
var (
    ErrNotFound     = NewError("NOT_FOUND", "resource not found")
    ErrUnauthorized = NewError("UNAUTHORIZED", "unauthorized access")
    ErrValidation   = NewError("VALIDATION_ERROR", "validation failed")
)

// ✅ 推荐：错误包装和链式调用
func (r *UserRepository) GetUserByID(ctx context.Context, id int64) (*User, error) {
    if id <= 0 {
        return nil, fmt.Errorf("%w: invalid user ID %d", ErrValidation, id)
    }

    var user User
    query := `SELECT id, username, email FROM users WHERE id = $1`

    err := r.db.QueryRowContext(ctx, query, id).Scan(
        &user.ID, &user.Username, &user.Email,
    )