Choosing Libraries for Go Web Servers

This is a creation in Article, where the information may have evolved or changed.

One of the hardest things about coming to a new language are figuring out which libraries your should use, especially for yo Ung languages like Go, where there is a bunch of competing options with no clear winners. As an example, for Node, there is an issue opened for it's NPM package Manager because there were 127 different bcrypt Li Braries.

This post would show some of the different choices I made in the libraries I use for the back-end to my end-point protectio N Product at Summit Route. As quick summary, I use the Goji web framework, some middleware, and the database library Gorp (with Postgres for my datab ASE).

Web Framework:goji

Go has a handful of web libraries and frameworks. The most light-weight option was to nakedly use the built-in net/http. Under the hood, all of the other options with this.

To get the ability to easily include middleware, I chose to go with Goji. I recommend Goji for those comfortable with Python ' s tornado or twisted libraries.

If you're comfortable with Python's Django or Ruby ' s Rails, you might is more comfortable with one of the Go ' s heavier we B Frameworks. Options here include Revel, gin, and Beego. Beego has heavy usage on the Chinese market among some top companies there.

If you search online for Go web frameworks, you'll see references to Martini. The creator of Martini decided to mostly stop supporting that library, and created Negroni. He explained his thoughts in his site. So do shouldn ' t use Martini. Negroni requires middleware for graceful shutdown and routing capability, so can decide what much you want built-in ver SUS being more easily extensible. For me, Goji is a good balance.

Looking online, you'll also see references to the Gorilla Toolkit which adds some additional functionality, and likely you ' ll pull from this toolkit for it's session library no matter which of the Web frameworks you use.

As meaningless as lines of code is, to give you some idea of what much heavier beego is than the other options, using the cloccommand on the git repos for the various projects give the following stats:

Project	Lines of Go code
Beego	26,510
Revel	7,278
Goji	4,131
Gorilla/mux	2,259
Gin	2,172
Martini	1,685
Negroni	590

Part of this extra code in Beego are the ORM for database access, it includes.

Goji Middleware

Goji doesn ' t need any extras but using the following middleware provides Nice-to-have ' s very easily.

Goji + Secure

Secure is a HTTP middleware for Go this adds HTTP headers to stop XSS, downgrade attacks, MIME type issues, and inline fr Ames. Your reverse proxy or load balancer may provide these for you configured it properly. Amazon ' s ELB does not, so you'll want to the use of this middleware for that architecture. To check for your server is providing the correct HTTP headers, test it against https://securityheaders.io/. This middleware also provides some SSL specific headers, but I recommend using a reverse proxy, such as Nginx or Amazon ' s ELB (Elastic Load Balancer), in front of the your service to take care of the and pass you plain HTTP.

Goji + Nosurf

Nosurf is CSRF protection middleware for Go. This means your HTML forms would include csrf_token values like this:

<formaction="/"method="POST"><inputtype="text"name="name"><inputtype="hidden"name="csrf_token"value="{{ .token }}"><inputtype="submit"value="Send"></form>

Goji + Glogrus

Glogrus provides structured logging via Logrus for Goji. What this means are your logs can be formatted as JSON so the services like Loggly or a privately hosted ELK (Elasticsearc H + logstache + Kibana) can parse them more easily without your needing to define the structure of the logs. This means your logs might look like:

{"level":"info","msg":"Authentication success","user":123,"time":"2014-04-02 19:57:38.562543128 -0400 EDT"}

Putting it all together

Once decide to use goji, you can just piece things together, but you'll probably want to see some "best practices" For a skeleton in how to set things up and structure where to put your files. One example is at Github.com/elcct/defaultproject It uses Goji, but uses MongoDB, and made some other library choices. A Fork of that, Haruyama/golang-goji-sample, uses MySQL with Gorp, which are closer to we needs, but still isn't quite right .

For example, both these projects use the popular Github.com/golang/glog from Rob Pike (one of the developers of Go), which Provides leveled logging as an improvement over the basic logging of the built-in log library. Levelled logging simply means you can emit info, warnings, and errors, and does some basic filtering on what ' ll actually Output. This library is too minimal. For example, all configuration options must is passed via command-line flags to your application, as opposed to passing CO Nfigs through a file, which I like to do. Additionally, I think structured logging is easier to sift through when your logging needs get bigger. However, when you ' re just debugging locally, structured logs is harder to read, so I actually use text logs when Debuggin G and structured logs when in production. Logrus makes this easy.

Using the server.go from that skeleton project, you can see a improved versionat this gist:

• Https://gist.github.com/0xdabbad00/98bb562f3abbe038cec6

In order to use Github.com/justinas/nosurf, in your system\middleware.go , add the functionfrom this gist:

• https://gist.github.com/0xdabbad00/1c9c6c293e57d5a24431

Database Access:gorp

Go has basic database access built-in via Database/sql and there is libraries to work easily with popular databases such As

• Postgres:github.com/lib/pq
• Mysql:github.com/go-sql-driver/mysql
• Sqlite:github.com/mattn/go-sqlite3

However, you'll likely want to add another layer of the functionality on top. I use Gorp, which are not quite and what do you ' d see in a full ORM. To show the different libraries, let's assume we have a users table and a simple variable defined as user :

typeUserstruct{    ID        int64    FirstNamestring    LastName  string    Email     string}varuserUser

Now I'll show you ' d do the same query in different libraries so can choose which one's syntax you like:

Database/sql

db.QueryRow("SELECT * FROM users WHERE id = ?",1).Scan(    &user.ID,    &user.FirstName,    &user.LastName,    &user.Email)

Gorp

db.SelectOne(&user,"SELECT * FROM users WHERE id = ?",1)

Gorp still makes you write SQL, but save ' s a bunch of typing. I don ' t like abstracting myself away too much from the "SQL like" and "the ORM" s below.

Beedb

db.Where("id=?",1).Find(&user)

Beedb have been deprecated in favor of beego.orm

Beego.orm

user=db.QueryTable("users").Filter("id",1)

Beego.orm is used by the Beego web framework.

Hood

db.Where("id","=","1").Limit(1).Find(&user)

Upper.io

db.Find(db.Cond{"id":1}).One(&user)

Squirrel

If you do want to build more complex queries with Gorp, you could use squirrel to generate your SQL.

SQL, args, _ := Sq.Select("*"). from("Users").Where(Sq.Eq{"id", 1}).Tosql()DB.SelectOne(&User, SQL, args)

Conclusion

Hopefully this helps those of your new to go!