static-server: an HTTP server in Go for static content
eli.thegreenplace.net
static-server: an HTTP server in Go for static content
1–10 of 67 posts
Re: static-server: an HTTP server in Go for static content
#2While I love Go, have we gotten this lazy that we need a package for this? Go does this in 3 lines minimum, like you describe in your blogpost. However, in your package you expose the ability to kill your server [0] without any security. That’s a huge vulnerability. I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your intent. It is the way. At the very least, use a secret token.
[0] https://github.com/eliben/static-server/blob/3ce83524ed54298...
Re: static-server: an HTTP server in Go for static content
#3While I love Go, have we gotten this lazy that we need a package for this? Go does this in 3 lines minimum, like you describe in your blogpost. However, in your package you expose the ability to kill your server [0] without any security. That’s a huge vulnerability. I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your int…
These kind of servers are useful for quickly serving a folder of files locally. Security isn't a primary concern for these kind of use cases.
Re: static-server: an HTTP server in Go for static content
#4While I love Go, have we gotten this lazy that we need a package for this? Go does this in 3 lines minimum, like you describe in your blogpost. However, in your package you expose the ability to kill your server [0] without any security. That’s a huge vulnerability. I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your int…
Thanks for your comment. I surely hope no one will even consider using this server for anything public-facing :) It's solely for testing on localhost.
The shutdown endpoint is used for robust testing; I suppose I can hide it a bit more, like using an environment variable or something.
Re: static-server: an HTTP server in Go for static content
#5While I love Go, have we gotten this lazy that we need a package for this? Go does this in 3 lines minimum, like you describe in your blogpost. However, in your package you expose the ability to kill your server [0] without any security. That’s a huge vulnerability. I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your int…
> I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your intent.
While true, I don't think the author should refrain from making code available based on the potential negatives from others using code they didn't even bother to read the documentation for.
Re: static-server: an HTTP server in Go for static content
#6While I love Go, have we gotten this lazy that we need a package for this? Go does this in 3 lines minimum, like you describe in your blogpost. However, in your package you expose the ability to kill your server [0] without any security. That’s a huge vulnerability. I know you’ll say “It’s just a static server, meant for serving static stuff” but it will be indexed by pkg.go.dev, people will use this outside your int…
These kind of servers are useful for quickly serving a folder of files locally. Security isn't a primary concern for these kind of use cases.
$ python -m http.server
Re: static-server: an HTTP server in Go for static content
#7Re: static-server: an HTTP server in Go for static content
#8Re: static-server: an HTTP server in Go for static content
#9These are fun to make. I've done it several times. :) That is why I wrote Caddy:
$ caddy file-server
$ caddy file-server --domain example.com
I think projects like static-server are wonderful learning examples of how to get Useful Things done in Go.
Re: static-server: an HTTP server in Go for static content
#10I wrote something like this [1] for the team at my old workplace. We mainly worked on static html files but some functionality required loading via http. Many of the devs were quite new to development in general, so I built a simple static server in Go, as an exe which they could set as the default for `.html` files, and therefore they could just open html files on the webserver via double-click as normal. The program would watch the directory (if not already open and watching) then open the right path in the default browser. I also built-in livereload, management via tray icon and a basic web UI.