Reusable starter application for authenticated server-rendered Go projects.
go-starter-auth-app wires together my reusable Go web modules into a working application foundation with login, sessions, protected routes, logout, SQLite persistence, security middleware, and server-rendered templates.
It is designed to be used as a GitHub template repository for new authenticated Go web projects.
- Go
net/http - SQLite database
- SQL migrations
- Structured logging
- Request middleware
- Server-side HTML rendering
- Login with bcrypt password verification
- Secure session-token generation
- Hashed session tokens in the database
- HTTP-only session cookies
- Protected routes
- Logout with session invalidation
- Cross-origin request protection
- Secure response headers
- Panic recovery
- Development and production configuration
- Automated vulnerability scanning support
/login GET, POST
/dashboard GET - authenticated only
/logout POST
GET /login renders the login form.
POST /login:
- Looks up the user by email.
- Verifies the supplied password.
- Generates a secure session token.
- Stores the hashed token in SQLite.
- Sets the raw token in an HTTP-only cookie.
- Redirects to
/dashboard.
Protected by authentication middleware.
Anonymous requests are redirected to:
/login
POST /logout:
- Reads the current session token.
- Hashes the token.
- Deletes the matching database session.
- Clears the browser session cookie.
- Redirects to
/login.
.
├── cmd
│ └── server
│ └── main.go
├── internal
│ └── auth
│ └── store.go
├── migrations
│ └── 001_auth.sql
├── web
│ └── templates
│ ├── dashboard.html
│ └── login.html
├── go.mod
├── go.sum
├── LICENSE
└── README.md
Runtime SQLite data should not be committed to the repository.
For example:
data/The starter uses SQLite.
The initial migration creates:
users
sessions
schema_migrations
The users table stores:
id
email
password_hash
created_at
The sessions table stores:
id
user_id
token_hash
expires_at
created_at
Raw session tokens are not stored in the database.
The browser receives the raw session token, while the database stores its SHA-256 hash.
email + password
↓
find user
↓
verify bcrypt hash
↓
generate random session token
↓
hash session token
↓
store hash in SQLite
↓
set raw token as HTTP-only cookie
↓
redirect to protected application
Clone the repository or create a new repository using this GitHub template.
Install/update dependencies:
go mod tidyRun the checks:
gofmt -w .
go test ./...
go vet ./...
govulncheck ./...
git diff --checkStart the application:
go run ./cmd/serverThe default server address is:
http://localhost:8080
The starter deliberately does not include public registration.
Applications can add their own:
- registration flow
- administrator-created users
- invitations
- account provisioning
- external identity provider
For development, generate a bcrypt password hash using go-web-auth/password.
Example:
package main
import (
"fmt"
"log"
"github.com/danieljmanningdev/go-web-auth/password"
)
func main() {
hash, err := password.Hash("change-me")
if err != nil {
log.Fatal(err)
}
fmt.Println(hash)
}Insert the generated hash into the development database:
INSERT INTO users (
email,
password_hash
)
VALUES (
'demo@example.com',
'YOUR_BCRYPT_HASH'
);Do not use example credentials or passwords in production.
Configuration is provided through go-web-core/config.
Supported environment variables include:
APP_ENV
APP_PORT
LOG_LEVEL
DATABASE_PATH
TEMPLATE_DIR
Defaults:
APP_ENV=development
APP_PORT=8080
LOG_LEVEL=info
DATABASE_PATH=./data/app.db
TEMPLATE_DIR=web/templates
Session cookies are configured as secure by default.
For non-production environments, this starter disables the Secure cookie flag so authentication can work over local HTTP.
Production applications should use HTTPS.
The starter uses go-web-security for:
- cross-origin request protection
- defensive HTTP response headers
- panic recovery
It uses go-web-auth for:
- bcrypt password hashing
- secure random session tokens
- SHA-256 session-token hashing
- HTTP-only session cookies
- authentication middleware
- protected routes
Security checks can be run with:
govulncheck ./...and optionally:
gosec ./...This repository is intended to be marked as a GitHub Template repository.
For a new project:
- Click Use this template on GitHub.
- Create the new project repository.
- Clone the new repository.
- Update the module path.
- Run
go mod tidy. - Add project-specific migrations, templates, handlers, and business logic.
Update the Go module path with:
go mod edit -module=github.com/YOUR-USERNAME/YOUR-PROJECTThen:
go mod tidyThe reusable modules remain versioned dependencies, so fixes and improvements can be pulled into future projects without copying their source code.
This repository contains reusable application wiring.
It should remain focused on:
application startup
database bootstrap
authentication wiring
session handling
security middleware
protected routing
basic templates
Client-specific functionality should be added in the project created from this template.
Examples include:
clients
projects
contracts
bookings
billing
documents
uploads
notifications
business-specific workflows
The reusable stack is split into two layers.
go-web-core
go-web-security
go-web-auth
These contain shared implementation.
go-starter-auth-app
This wires those modules together into a ready-to-extend project structure.
The goal is:
Start new authenticated Go projects with the infrastructure already working and spend development time on the client-specific product instead.
Format:
gofmt -w .Test:
go test ./...Static analysis:
go vet ./...Vulnerability scan:
govulncheck ./...Whitespace check:
git diff --checkThis project is an early reusable starter and may evolve as it is used across real projects.
See LICENSE.