Golang中如何安全地实现REST API

在 Golang 中实现安全的 REST API 需要多层次的防护措施。以下是关键的安全实践和代码示例：

1. 强制使用 HTTPS

import (
    "log"
    "net/http"
)

func main() {
    mux := http.NewServeMux()
    mux.HandleFunc("/api/data", func(w http.ResponseWriter, r *http.Request) {
        w.Write([]byte("Secure data"))
    })
    
    // 重定向 HTTP 到 HTTPS
    go func() {
        log.Fatal(http.ListenAndServe(":80", http.HandlerFunc(
            func(w http.ResponseWriter, r *http.Request) {
                http.Redirect(w, r, "https://"+r.Host+r.RequestURI, 
                    http.StatusMovedPermanently)
            })))
    }()
    
    log.Fatal(http.ListenAndServeTLS(":443", "server.crt", "server.key", mux))
}

2. 认证与授权

JWT 认证示例

import (
    "github.com/golang-jwt/jwt/v5"
    "net/http"
    "time"
)

var jwtKey = []byte("your-secret-key")

func createToken(username string) (string, error) {
    token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
        "username": username,
        "exp":      time.Now().Add(time.Hour * 24).Unix(),
    })
    return token.SignedString(jwtKey)
}

func authMiddleware(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        tokenStr := r.Header.Get("Authorization")
        if tokenStr == "" {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        
        token, err := jwt.Parse(tokenStr, func(token *jwt.Token) (interface{}, error) {
            return jwtKey, nil
        })
        
        if err != nil || !token.Valid {
            http.Error(w, "Unauthorized", http.StatusUnauthorized)
            return
        }
        
        next.ServeHTTP(w, r)
    }
}

3. 输入验证与清理

import (
    "github.com/go-playground/validator/v10"
    "net/http"
)

type UserInput struct {
    Username string `json:"username" validate:"required,alphanum,min=3,max=50"`
    Email    string `json:"email" validate:"required,email"`
    Age      int    `json:"age" validate:"required,min=18,max=120"`
}

var validate = validator.New()

func createUserHandler(w http.ResponseWriter, r *http.Request) {
    var input UserInput
    if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
        http.Error(w, "Invalid input", http.StatusBadRequest)
        return
    }
    
    if err := validate.Struct(input); err != nil {
        http.Error(w, err.Error(), http.StatusBadRequest)
        return
    }
    
    // 处理安全的数据
}

4. 防止常见攻击

SQL 注入防护

import (
    "database/sql"
    _ "github.com/lib/pq"
)

func getUserSafe(db *sql.DB, userID string) error {
    // 使用参数化查询
    row := db.QueryRow("SELECT * FROM users WHERE id = $1", userID)
    var user User
    err := row.Scan(&user.ID, &user.Name)
    return err
}

CORS 配置

import (
    "github.com/rs/cors"
    "net/http"
)

func main() {
    mux := http.NewServeMux()
    mux.HandleFunc("/api/data", dataHandler)
    
    c := cors.New(cors.Options{
        AllowedOrigins:   []string{"https://example.com"},
        AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE"},
        AllowedHeaders:   []string{"Authorization", "Content-Type"},
        AllowCredentials: true,
        MaxAge:           86400,
    })
    
    handler := c.Handler(mux)
    http.ListenAndServe(":8080", handler)
}

5. 速率限制

import (
    "golang.org/x/time/rate"
    "net/http"
)

var limiter = rate.NewLimiter(rate.Limit(100), 30) // 100 req/sec, burst 30

func rateLimitMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if !limiter.Allow() {
            http.Error(w, "Too many requests", http.StatusTooManyRequests)
            return
        }
        next.ServeHTTP(w, r)
    })
}

6. gRPC 安全实现

import (
    "crypto/tls"
    "crypto/x509"
    "google.golang.org/grpc"
    "google.golang.org/grpc/credentials"
)

func setupSecureGRPCServer() {
    // 加载 TLS 证书
    cert, err := tls.LoadX509KeyPair("server.crt", "server.key")
    if err != nil {
        log.Fatal(err)
    }
    
    // 创建 TLS 配置
    tlsConfig := &tls.Config{
        Certificates: []tls.Certificate{cert},
        ClientAuth:   tls.RequireAndVerifyClientCert,
        ClientCAs:    loadCA("ca.crt"),
    }
    
    // 创建 gRPC 服务器
    s := grpc.NewServer(
        grpc.Creds(credentials.NewTLS(tlsConfig)),
    )
    
    // 注册服务并启动
}

func loadCA(caFile string) *x509.CertPool {
    caCert, err := os.ReadFile(caFile)
    if err != nil {
        log.Fatal(err)
    }
    caCertPool := x509.NewCertPool()
    caCertPool.AppendCertsFromPEM(caCert)
    return caCertPool
}

7. 请求日志与监控

import (
    "log"
    "net/http"
    "time"
)

func loggingMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        start := time.Now()
        
        rw := &responseWriter{w, http.StatusOK}
        next.ServeHTTP(rw, r)
        
        log.Printf("%s %s %d %v", r.Method, r.URL.Path, rw.status, time.Since(start))
    })
}

type responseWriter struct {
    http.ResponseWriter
    status int
}

func (rw *responseWriter) WriteHeader(code int) {
    rw.status = code
    rw.ResponseWriter.WriteHeader(code)
}

这些安全措施需要结合使用，根据具体业务需求调整配置参数。对于生产环境，建议使用专业的 API 网关（如 Kong、Tyk）或服务网格（如 Istio）来增强 API 安全性。