Setting HTTP Response Headers and Handling CORS in Go: From Basics to Practice

Basic Methods for Setting HTTP Response Headers

In Go, when building web servers with the net/http package, setting HTTP response headers is a common requirement. Developers can access the response header map via the Header() method of the http.ResponseWriter interface and use the Set() method to add or modify header fields. For instance, to allow cross-domain AJAX requests, set the Access-Control-Allow-Origin header to *, indicating that requests from any origin are permitted. Here is a simple example code snippet:

func saveHandler(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Access-Control-Allow-Origin", "*")
    // Other processing logic
}

This approach is suitable for most basic scenarios, but note that headers must be set before writing to the response body, as once the body writing begins, headers cannot be modified. Additionally, for more complex applications, other CORS-related headers such as Access-Control-Allow-Methods and Access-Control-Allow-Headers may be necessary to support specific HTTP methods and custom headers.

Advanced Solutions for Handling CORS Preflight Requests

In real-world web development, especially when requests include custom headers or non-simple methods, browsers send OPTIONS preflight requests to verify server permission for cross-origin access. If not handled properly, this can lead to CORS failures. To fully support CORS, developers can customize server structs to override the default ServeHTTP method. Here is an example using the gorilla/mux router:

type MyServer struct {
    r *mux.Router
}

func (s *MyServer) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
    if origin := req.Header.Get("Origin"); origin != "" {
        rw.Header().Set("Access-Control-Allow-Origin", origin)
        rw.Header().Set("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT, DELETE")
        rw.Header().Set("Access-Control-Allow-Headers",
            "Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization")
    }
    if req.Method == "OPTIONS" {
        return
    }
    s.r.ServeHTTP(rw, req)
}

func main() {
    r := mux.NewRouter()
    r.HandleFunc("/save", saveHandler)
    http.Handle("/", &MyServer{r})
    http.ListenAndServe(":8080", nil)
}

In this solution, the custom server checks the request's Origin header and dynamically sets the allowed origin, methods, and headers for CORS. For OPTIONS requests, the server returns immediately without further routing, ensuring successful responses to preflight requests. This method offers greater flexibility and security, making it suitable for production environments requiring fine-grained CORS policies.

Practical Recommendations and Considerations

When implementing HTTP header settings and CORS handling, developers should consider the following points: First, avoid setting overly permissive values like * for Access-Control-Allow-Origin in production; instead, specify exact domains to enhance security. Second, ensure all relevant CORS headers, such as Access-Control-Allow-Credentials, are correctly configured based on application needs. Finally, when testing cross-origin requests, use tools like browser developer tools or curl to verify that header settings are effective. By combining basic methods with advanced customization, developers can build efficient and secure Go web applications.