← Home

Implementing HSTS as Go Middleware

This week, I launched a new application, having bought a domain, setup a load balancer with an SSL certificate etc.

Unfortunately my new Go app didn’t have a feature to redirect the user from HTTP to HTTPS automatically, meaning that it was possible for the user to send data without it being encrypted.

I needed my Go app to detect when the user was accessing the system over HTTP and get them to use HTTPS instead so I created some middleware to do it.

This is straightforward if the Go app is handling SSL itself, but in my case, I had the extra complexity of using an AWS Elastic Load Balancer (ELB) to manage the SSL for me - meaning that the Go application just sees incoming traffic.

The AWS ELB adds a HTTP header called X-Forwarded-Scheme to request which I can use to determine whether the incoming request was HTTP or HTTPS. So I used the [0] middleware to collect the value and pass it to the [1] struct (r.URL.Scheme`) making my middleware work for both scenarios.

Since I always want people to use HTTPS to access the system, I also added a HSTS header which sets user’s browsers to automatically use HTTPS, even when presented with a HTTP URL in the future.

You can use it in your projects by the usual method of go get github.com/a-h/hsts - work with me on it at [2]