HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
justinas
nosurf
Go2013–2016
justinas / nosurf

nosurf

CSRF protection middleware for Go.

Security & Privacy
Explore on GitHubRead Hacker News discussions
4Distinct people
4Mentions
0Explicit recommenders
1.8KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

CSRF protection middleware for Go.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month4 dated mentions

Observed mentions: 2013-09-01 08:31:11 UTC to 2016-02-25 14:42:01 UTC.

012013-09-01 00:00:00 UTC to 2013-10-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 commentsSep 20132013-10-01 00:00:00 UTC to 2013-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2013-11-01 00:00:00 UTC to 2013-12-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2013-12-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-01-01 00:00:00 UTC to 2014-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-02-01 00:00:00 UTC to 2014-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-03-01 00:00:00 UTC to 2014-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-04-01 00:00:00 UTC to 2014-05-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-05-01 00:00:00 UTC to 2014-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-06-01 00:00:00 UTC to 2014-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-07-01 00:00:00 UTC to 2014-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-08-01 00:00:00 UTC to 2014-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-09-01 00:00:00 UTC to 2014-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-10-01 00:00:00 UTC to 2014-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-11-01 00:00:00 UTC to 2014-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsNov 20142014-12-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-01-01 00:00:00 UTC to 2015-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-02-01 00:00:00 UTC to 2015-03-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-03-01 00:00:00 UTC to 2015-04-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-04-01 00:00:00 UTC to 2015-05-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2015-05-01 00:00:00 UTC to 2015-06-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-06-01 00:00:00 UTC to 2015-07-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-07-01 00:00:00 UTC to 2015-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-08-01 00:00:00 UTC to 2015-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-09-01 00:00:00 UTC to 2015-10-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-10-01 00:00:00 UTC to 2015-11-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-11-01 00:00:00 UTC to 2015-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2015-12-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-01-01 00:00:00 UTC to 2016-02-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2016-02-01 00:00:00 UTC to 2016-03-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsFeb 2016

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Sep 20132013-09-01 00:00:00 UTC2013-10-01 00:00:00 UTC110
Oct 20132013-10-01 00:00:00 UTC2013-11-01 00:00:00 UTC000
Nov 20132013-11-01 00:00:00 UTC2013-12-01 00:00:00 UTC101
Dec 20132013-12-01 00:00:00 UTC2014-01-01 00:00:00 UTC000
Jan 20142014-01-01 00:00:00 UTC2014-02-01 00:00:00 UTC000
Feb 20142014-02-01 00:00:00 UTC2014-03-01 00:00:00 UTC000
Mar 20142014-03-01 00:00:00 UTC2014-04-01 00:00:00 UTC000
Apr 20142014-04-01 00:00:00 UTC2014-05-01 00:00:00 UTC000
May 20142014-05-01 00:00:00 UTC2014-06-01 00:00:00 UTC000
Jun 20142014-06-01 00:00:00 UTC2014-07-01 00:00:00 UTC000
Jul 20142014-07-01 00:00:00 UTC2014-08-01 00:00:00 UTC000
Aug 20142014-08-01 00:00:00 UTC2014-09-01 00:00:00 UTC000
Sep 20142014-09-01 00:00:00 UTC2014-10-01 00:00:00 UTC000
Oct 20142014-10-01 00:00:00 UTC2014-11-01 00:00:00 UTC000
Nov 20142014-11-01 00:00:00 UTC2014-12-01 00:00:00 UTC000
Dec 20142014-12-01 00:00:00 UTC2015-01-01 00:00:00 UTC000
Jan 20152015-01-01 00:00:00 UTC2015-02-01 00:00:00 UTC000
Feb 20152015-02-01 00:00:00 UTC2015-03-01 00:00:00 UTC000
Mar 20152015-03-01 00:00:00 UTC2015-04-01 00:00:00 UTC000
Apr 20152015-04-01 00:00:00 UTC2015-05-01 00:00:00 UTC101
May 20152015-05-01 00:00:00 UTC2015-06-01 00:00:00 UTC000
Jun 20152015-06-01 00:00:00 UTC2015-07-01 00:00:00 UTC000
Jul 20152015-07-01 00:00:00 UTC2015-08-01 00:00:00 UTC000
Aug 20152015-08-01 00:00:00 UTC2015-09-01 00:00:00 UTC000
Sep 20152015-09-01 00:00:00 UTC2015-10-01 00:00:00 UTC000
Oct 20152015-10-01 00:00:00 UTC2015-11-01 00:00:00 UTC000
Nov 20152015-11-01 00:00:00 UTC2015-12-01 00:00:00 UTC000
Dec 20152015-12-01 00:00:00 UTC2016-01-01 00:00:00 UTC000
Jan 20162016-01-01 00:00:00 UTC2016-02-01 00:00:00 UTC000
Feb 20162016-02-01 00:00:00 UTC2016-03-01 00:00:00 UTC101

What Hacker News says

4 sources
dchest·Apr 8, 2015
A perfectly maintained package would look like this: - uses proper stable versioning (e.g. gopkg.in), making sure not to introduce breaking changes in the same major version - backports critical/security fixes into previous stable versions - has their code reviewed by a third party - provides notifications for critical fixes/security advisories - provides support for package users Not all packages are perfectly maintained, though (even my personal packages are not). Consider this sample of third-party packages from one of my project: github.com/boltdb/bolt github.com/dchest/cache github.com/dchest/conf github.com/dchest/validator github.com/hashicorp/logutils github.com/justinas/nosurf github.com/stretchr/graceful github.com/stretchr/pat/stop golang.org/x/crypto/bcrypt golang.org/x/crypto/blowfish
Read the rest
golang.org/x/net/netutil If I'm having a production app running that uses these packages, I have to track all of them, making sure I don't miss some critical bug fix. StableLib will do this for you: just subscribe and you'll get notified of updates, and you will receive backported fixes, so that you can update without worrying of breaking our apps.
In StableLib – Stable Distribution of Go Packages
elithrar·Nov 12, 2013
web.go is definitely pretty old/semi-abandoned. I wouldn't recommend Revel to many (it's Play heritage isn't well suited to Go, IMO) but the Gorilla toolkit—a collection of useful packages that extend net/http, rather than a full-blown framework—is exceptional. mux/pat, schema and sessions are all such useful tools and I've been working with them for a couple of months [in my spare time] as I build a web app w/ Go as a non-programmer. Some other solid Go web packages/tools: • beego (https://github.com/astaxie/beego) - a well-maintained, active project if you want to head down the framework route. Closer to Sinatra/Flask than Django/Rails. • "Bones" (https://github.com/peterskeide/bones) - a useful template for an application/some good design patterns • nosurf (https://github.com/justinas/nosurf) - CSRF middleware that plugs into net/http
Read the rest
(and therefore works with gorilla/mux or pat) • gorilla/context (http://github.com/gorilla/context) - request context. Great for passing per-request variables (i.e. CSRF tokens, saved forms, etc) between your middleware and your wrapped handlers. Set up some Get and Set wrappers around your specific keys so you can avoid writing out type assertions every time you want to retrieve the stored object. • go.stripe (https://github.com/drone/go.stripe) - a fairly complete Stripe library. • blackfriday (https://github.com/russross/blackfriday) - Markdown processor. Obviously, frameworks (and ecosystems...) like Flask, Sinatra, Django and Rails have an advantage in that you can get stuff done today: they do a lot for you. And, for many use-cases, performance will never be a problem. Saying that, writing HTTP logic in Go has been surprisingly easy, and the small amount of extra boilerplate you have to write (if you're sans-framework like me) is nice when you realise how darned fast your application is. Being able to deploy a single binary and front-end it with nginx also reduces a ton of complexity. PS: Once I finish this thing off over the Christmas break, I'm hoping to write up a few articles on the bits-and-pieces that took a bit of time to "get right". Also have a minimalist (i.e. wraps HandleFunc, not Handler) CSRF package in the works.
In Web.go – Web applications with Go

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.