Implementing HSTS as Go Middleware


This week, I launched a new application, having bought a domain, setup a load balancer with an SSL certificate etc.

Unfortunately my new Go app didn’t have a feature to redirect the user from HTTP to HTTPS automatically, meaning that it was possible for the user to send data without it being encrypted.

I needed my Go app to detect when the user was accessing the system over HTTP and get them to use HTTPS instead so I created some middleware to do it.

This is straightforward if the Go app is handling SSL itself, but in my case, I had the extra complexity of using an AWS Elastic Load Balancer (ELB) to manage the SSL for me - meaning that the Go application just sees incoming traffic.

The AWS ELB adds a HTTP header called X-Forwarded-Scheme to request which I can use to determine whether the incoming request was HTTP or HTTPS. So I used the middleware to collect the value and pass it to the http.Request struct (r.URL.Scheme) making my middleware work for both scenarios.

Since I always want people to use HTTPS to access the system, I also added a HSTS header which sets user’s browsers to automatically use HTTPS, even when presented with a HTTP URL in the future.

You can use it in your projects by the usual method of go get - work with me on it at