# Go application security

Published articles for Go application security.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Ep. 10: Building Secure Go Systems: Key Management, Middleware, and Error Handling

DevFeed: [Ep. 10: Building Secure Go Systems: Key Management, Middleware, and Error Handling](<https://devfeed.tech/articles/ep-10-building-secure-go-systems-key-management-middleware-and-error-handling-22247.md>)

Original publisher: [Read original article](<https://www.ardanlabs.com/blog/2024/07/building-secure-go-systems-key-management-middleware-and-error-handling-ep-10.html>)

Published: 2024-07-23T00:00:00Z

Content type: tutorial

Language: en

Sources: [William Kennedy](<https://devfeed.tech/sources/william-kennedy.md>)

Topics: [Go Language](<https://devfeed.tech/topics/go-language.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>), [Security](<https://devfeed.tech/topics/security.md>), [Software Engineering](<https://devfeed.tech/topics/software-engineering.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authentication-in-go](<https://devfeed.tech/tags/authentication-in-go.md>), [authentication-middleware-go](<https://devfeed.tech/tags/authentication-middleware-go.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [authorization-in-go](<https://devfeed.tech/tags/authorization-in-go.md>), [authorization-middleware-go](<https://devfeed.tech/tags/authorization-middleware-go.md>), [best-practices-for-go-security](<https://devfeed.tech/tags/best-practices-for-go-security.md>), [building-secure-go-systems](<https://devfeed.tech/tags/building-secure-go-systems.md>), [centralized-error-handling-go](<https://devfeed.tech/tags/centralized-error-handling-go.md>), [context](<https://devfeed.tech/tags/context.md>), [context-management-go](<https://devfeed.tech/tags/context-management-go.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [cryptographic-keys-go](<https://devfeed.tech/tags/cryptographic-keys-go.md>), [docker-deployment-go-security](<https://devfeed.tech/tags/docker-deployment-go-security.md>), [error-handling](<https://devfeed.tech/tags/error-handling.md>), [go](<https://devfeed.tech/tags/go.md>), [go-application-security](<https://devfeed.tech/tags/go-application-security.md>), [go-authentication-and-authorization](<https://devfeed.tech/tags/go-authentication-and-authorization.md>), [go-authentication-strategies](<https://devfeed.tech/tags/go-authentication-strategies.md>), [go-authorization-strategies](<https://devfeed.tech/tags/go-authorization-strategies.md>), [go-error-handling-best-practices](<https://devfeed.tech/tags/go-error-handling-best-practices.md>), [go-error-management](<https://devfeed.tech/tags/go-error-management.md>), [go-key-management](<https://devfeed.tech/tags/go-key-management.md>), [go-middleware-functions](<https://devfeed.tech/tags/go-middleware-functions.md>), [go-request-handling-pipeline](<https://devfeed.tech/tags/go-request-handling-pipeline.md>), [go-software-security](<https://devfeed.tech/tags/go-software-security.md>), [go-token-handling](<https://devfeed.tech/tags/go-token-handling.md>), [keystore-integration-go](<https://devfeed.tech/tags/keystore-integration-go.md>), [managing-cryptographic-keys-in-go](<https://devfeed.tech/tags/managing-cryptographic-keys-in-go.md>), [middleware](<https://devfeed.tech/tags/middleware.md>), [middleware-in-go-applications](<https://devfeed.tech/tags/middleware-in-go-applications.md>), [role-based-access-control-go](<https://devfeed.tech/tags/role-based-access-control-go.md>), [secure-go-applications](<https://devfeed.tech/tags/secure-go-applications.md>), [secure-go-deployment](<https://devfeed.tech/tags/secure-go-deployment.md>), [secure-go-systems](<https://devfeed.tech/tags/secure-go-systems.md>), [token-parsing-go](<https://devfeed.tech/tags/token-parsing-go.md>), [user-id-extraction-go](<https://devfeed.tech/tags/user-id-extraction-go.md>)

### AI overview

Episode 10 of a Go software design series explains how to build secure systems by managing cryptographic keys with a KeyStore, adding authentication and authorization middleware, enforcing role-based access control, and centralizing error handling and request context management.

### Source excerpt

Introduction: Welcome to Episode 10 of our Ultimate Software Design series! In this episode, Bill dives into the integration of authentication and authorization mechanisms within Go packages, providing developers with essential strategies for securing and maintaining their software systems. Learn to configure and manage cryptographic keys using a KeyStore and integrate it into your Go applications. Discover how to create middleware functions for token parsing, user ID extraction, and role-based access control.

## Ep. 8: Enhancing Go Application Security with JWT and OPA

DevFeed: [Ep. 8: Enhancing Go Application Security with JWT and OPA](<https://devfeed.tech/articles/ep-8-enhancing-go-application-security-with-jwt-and-opa-22249.md>)

Original publisher: [Read original article](<https://www.ardanlabs.com/blog/2024/07/enhancing-go-application-security-with-jwt-and-opa-ep-8.html>)

Published: 2024-07-02T00:00:00Z

Content type: tutorial

Language: en

Sources: [William Kennedy](<https://devfeed.tech/sources/william-kennedy.md>)

Topics: [Go Language](<https://devfeed.tech/topics/go-language.md>), [Security](<https://devfeed.tech/topics/security.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [Open Policy Agent](<https://devfeed.tech/topics/open-policy-agent.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>)

Tags: [access-control-policies-go](<https://devfeed.tech/tags/access-control-policies-go.md>), [advanced-go-security-tools](<https://devfeed.tech/tags/advanced-go-security-tools.md>), [application-security](<https://devfeed.tech/tags/application-security.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authentication-vs-authorization](<https://devfeed.tech/tags/authentication-vs-authorization.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [comprehensive-security-framework-go](<https://devfeed.tech/tags/comprehensive-security-framework-go.md>), [dynamic-authorization-rules](<https://devfeed.tech/tags/dynamic-authorization-rules.md>), [embedding-opa-scripts-go](<https://devfeed.tech/tags/embedding-opa-scripts-go.md>), [external-service-opa](<https://devfeed.tech/tags/external-service-opa.md>), [flexible-authorization-go](<https://devfeed.tech/tags/flexible-authorization-go.md>), [go](<https://devfeed.tech/tags/go.md>), [go-application-security](<https://devfeed.tech/tags/go-application-security.md>), [go-application-security-guide](<https://devfeed.tech/tags/go-application-security-guide.md>), [go-authentication](<https://devfeed.tech/tags/go-authentication.md>), [go-authorization](<https://devfeed.tech/tags/go-authorization.md>), [go-developer-security](<https://devfeed.tech/tags/go-developer-security.md>), [go-security-best-practices](<https://devfeed.tech/tags/go-security-best-practices.md>), [go-security-frameworks](<https://devfeed.tech/tags/go-security-frameworks.md>), [go-token-expiration-management](<https://devfeed.tech/tags/go-token-expiration-management.md>), [implementing-jwt-go](<https://devfeed.tech/tags/implementing-jwt-go.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [jwt-private-key-signing](<https://devfeed.tech/tags/jwt-private-key-signing.md>), [jwt-token-generation](<https://devfeed.tech/tags/jwt-token-generation.md>), [jwt-validation-go](<https://devfeed.tech/tags/jwt-validation-go.md>), [opa](<https://devfeed.tech/tags/opa.md>), [opa-go-tutorial](<https://devfeed.tech/tags/opa-go-tutorial.md>), [open-policy-agent-go](<https://devfeed.tech/tags/open-policy-agent-go.md>), [public-key-verification-jwt-go](<https://devfeed.tech/tags/public-key-verification-jwt-go.md>), [reliable-authentication-go](<https://devfeed.tech/tags/reliable-authentication-go.md>), [robust-go-authentication](<https://devfeed.tech/tags/robust-go-authentication.md>), [scalable-security-go](<https://devfeed.tech/tags/scalable-security-go.md>), [secure-go-applications](<https://devfeed.tech/tags/secure-go-applications.md>), [secure-token-management](<https://devfeed.tech/tags/secure-token-management.md>), [security](<https://devfeed.tech/tags/security.md>), [updating-access-control-policies-go](<https://devfeed.tech/tags/updating-access-control-policies-go.md>), [verifying-user-identity-go](<https://devfeed.tech/tags/verifying-user-identity-go.md>)

### AI overview

This episode explains authentication and authorization for Go applications, including JWT generation, signing, validation, and expiration management. It also introduces Open Policy Agent for managing dynamic authorization rules separately from application code.

### Source excerpt

Introduction: In this segment, Bill delves into the fundamental aspects of authentication and authorization, equipping Go developers with essential knowledge and advanced tools to enhance the security of their applications. Through practical examples and detailed explanations, he unpacks the intricacies of these concepts, demonstrating their crucial role in protecting and managing access to your software systems. Learn the distinct roles of verifying user identity and determining access levels. Discover how to use JWTs for secure token generation, validation, and expiration management.