DEV Community: CK L

Serving Static Files with Custom Headers using Golang

CK L — Fri, 11 Jun 2021 06:08:18 +0000

Basic Golang Static File Server

One of the common uses for Golang is to create servers to serve content, be it an API, or serve some files. Develop APIs long enough and soon you'll find yourself needing to serve static content such as HTML, JS, CSS.

Let's use the following as an example:

index.html:



<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>Basic HTML Document</title>
  </head>
  <link
    href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.1/dist/css/bootstrap.min.css"
    rel="stylesheet"
    integrity="sha384-+0n0xVW2eSR5OomGNYDnhzAbDsOXxcvSN1TPprVMTNDbiYZCxYbOOl7+AMvyTG2x"
    crossorigin="anonymous"
  />
  <link rel="stylesheet" href="style.css">
  <body>
    <h1><TITLE></TITLE></h1>
    <script src="script.js"></script>
    <div class="blue">This is Blue</div>
    <button class="btn btn-primary m-5">Bootstrap Button</button>
  </body>
</html>

script.js:



document.write('this comes from a script')

style.css:



.blue {
  background-color: blue;
  color: white;
}

The first step is to put the following files inside a folder we conveniently named static. Next we create a main.go at the root directory, and the folder structure of your project will look like this:



.
├── main.go
└── static
    ├── index.html
    ├── script.js
    └── style.css

A simple version of a file serving server written in Go takes advantage of the http.FileServer method.

main.go:



package main

import (
    "fmt"
    "log"
    "net/http"
)

func main() {
    fs := http.FileServer(http.Dir("./static"))
    http.Handle("/", fs)

    fmt.Printf("Server started at port 3000")
    err := http.ListenAndServe(":3000", nil)
    if err == nil {
        log.Fatal(err)
    }
}

Running the above with go run main.go and browsing http://localhost:3000 will show you the following page:

Example Static Site

Now if that is all you need, you would do well to stop here and be on your merry way. However, often times in production you may want to add certain headers to the docume
nt request response for security purposes.

X-Frame-Options Header Ramblings

An example of such a header is the X-Frame-Options header. A part of Clickjacking attacks is that the attacker may embed the main site in an <iframe> tag, thus allowing the attacker's site to snoop on the user's input while impersonating a different site.

Clickjacking Example

What the X-Frame-Options header does is that it tells the browser that it only allows the domain of say legitsite.com to put the response inside an <iframe> tag, so the illegitimate leg1tsite.com would not be able to put the content of legitsite.com inside an <iframe> because the browser would not agree to render it.

Clickjacking Prevention

Of course this is not the only security header required to secure a website, but for more information on common web vulnerabilities do check out owasp.org

Implementing headers using `http.FileServer`

So the idea of implementing headers is by creating a wrapper over the fs variable, serving as a middleware. Of course, while we are applying the X-Frame-Options header in the wrapper, one can do all sorts of preprocessing in the wrapper, allowing you to solve more problems than just adding headers. main.go then is changed to the following:

main.go:



package main

import (
    "fmt"
    "log"
    "net/http"
)

func main() {
    fs := http.FileServer(http.Dir("./static"))
    http.Handle("/", addHeaders(fs))

    fmt.Printf("Server started at port 3000")
    err := http.ListenAndServe(":3000", nil)
    if err == nil {
        log.Fatal(err)
    }
}

func addHeaders(fs http.Handler) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        w.Header().Add("X-Frame-Options", "DENY")
        fs.ServeHTTP(w, r)
    }
}

With this change, you are done! All document requests to localhost will have the X-Frame-Options header, as well as any headers you wish to add.

Response With Added Headers

Simple Golang + Mux Router API Service

CK L — Tue, 22 Dec 2020 17:35:22 +0000

Maybe you want to create a simple Golang REST API, to test the language out. This tutorial aims to build a simple API Service that returns a hardcoded json using the Mux Router library

Objectives

Create a simple API on a port that returns a { "hello": "world" } JSON

Setting up libraries and `main.go`

Start by setting up the go modules

go mod init simple-backend
go get github.com/gorilla/mux # this is the mux library

Set up main.go

// main.go
package main

func main() {
  // to be filled later
}

Your project folder structure should now look like this:

.
├── go.mod
├── go.sum
└── main.go

Setting up `app.go`

We set up the app.go to house all the app's main logic, e.g. app.run() and app.initialiseRoutes() methods.

Add app.go on the root directory level:

.
├── app.go # add here
├── go.mod
├── go.sum
└── main.go

Add the App type, which houses the mux router, and add the relevant methods run() and initialiseRoutes()

// app.go
package main

import (
    "log"
    "net/http"

    "github.com/gorilla/mux"
)

// App export
type App struct {
    Router *mux.Router
}

// TODO: add handlers here

func (app *App) initialiseRoutes() {
  app.Router = mux.NewRouter()
  // TODO: add routes here
}

func (app *App) run() {
    log.Fatal(http.ListenAndServe(":8080", app.Router))
}

We have a few TODO's to complete. Lets start by adding the handler and some helper functions for future use.

That being said, when the number of handlers grow, we will have to find a new folder for them to be in. For now though app.go should do just fine.

// TODO: add handlers here
func helloWorldHandler(w http.ResponseWriter, r *http.Request) {
    var response map[string]interface{}
    json.Unmarshal([]byte(`{ "hello": "world" }`), &response)
    respondWithJSON(w, http.StatusOK, response)
}

func respondWithJSON(w http.ResponseWriter, code int, payload interface{}) {
    w.Header().Set("Content-Type", "application/json")
    w.WriteHeader(code)
    json.NewEncoder(w).Encode(payload)
}

Here the handler's function signature should match

func handlerFunc(w http.ResponseWriter, r *http.Request)

at least that is what the

mux.Router.HandleFunc(path, handlerFunc)

expects anyway.

On the other hand, the respondWithJSON() function helps us pass any struct over to the http.responseWriter to be sent back to the client. Anyway, for future handlers we decide to implement, we can always reuse this helper function to feed the structs back to the client.

Finish up the initialiseRoutes() to use the handler function

Inside the initialiseRoutes() function, we add the routes.

func (app *App) initialiseRoutes() {
    app.Router = mux.NewRouter()
  // TODO: add routes here
    app.Router.HandleFunc("/", helloWorldHandler)
}

We could add a few routes here as we wish, but here we add the helloWorldHandler to the path / so that the request localhost:8080 would be routed to the helloWorldHandler

The app.go should end up like below:

// app.go
package main

import (
    "encoding/json"
    "log"
    "net/http"

    "github.com/gorilla/mux"
)

// App export
type App struct {
    Router *mux.Router
}

func helloWorldHandler(w http.ResponseWriter, r *http.Request) {
    var response map[string]interface{}
    json.Unmarshal([]byte(`{ "hello": "world" }`), &response)
    respondWithJSON(w, http.StatusOK, response)
}

func respondWithJSON(w http.ResponseWriter, code int, payload interface{}) {
    w.Header().Set("Content-Type", "application/json")
    w.WriteHeader(code)
    json.NewEncoder(w).Encode(payload)
}

func (app *App) initialiseRoutes() {
    app.Router = mux.NewRouter()
    app.Router.HandleFunc("/", helloWorldHandler)
}

func (app *App) run() {
    log.Fatal(http.ListenAndServe(":8080", app.Router))
}

Finish up `main.go`

Here we finish up our main.go, adding the run() and the initialiseRoutes() to the entrace function

The main.go should end up like so:

// main.go
package main

func main() {
    app := App{}
    app.initialiseRoutes()
    app.run()
}

Start the server

...and we should be good to go! Now run the below command to start the server from the project root directory:

go run .

or, you can build an executable and run it

go build 
./simple-backend # don't forget to put this inside your .gitignore!

and, you can test the server using

curl localhost:8080
{"hello":"world"}

Conclusion

...and there you have it! A simple Golang API server using the Mux router library.

However, in an actual application, the functionality would not be as simple as returning a mere "hello world" response. Next time, we will be improving on this project, tidying up the folder structure and adding more functionality to it.