> One reason I am super gung-ho about Golang for an API or website, is it came with the net http listener package, html/template package, and has several fairly

> One reason I am super gung-ho about Golang for an API or website, is it came with the net http listener package, html/template package, and has several fairly well made open source packages (and standard packages) for secure sessions, CSRF tokens, output filtering, shelling out, so much more... I'd argue that it's not a good thing. net/http is flawed. They either should have done like Nodejs , provide something barebone or provide something with more features. Why provide some embryo of a router(since it supports some form of string pattern matching) without supporting route variables? The result is people go through hoops to try to keep a certain level of compatibility with the default handler signature while trying to add features, and it leads to a galaxy of horrible packages,because net/http is all you need ... no it isn't . > Without these types of features, people are doomed to build web-apps no more secure than everyone's first, broken, PHP webapp. But Go net/http doesn't magically make an app secure either, on the contrary. It doesn't put some CSRF token by magic in your forms, or force tsl , or force strong parameters when de-serializing form data to an entity that has to be persisted in the DB , or come with any kind of extensive data validation framework , or force http only cookies by default ... so it's not much more secure that your first broken PHP webapp ... My point is Go isn't magically more secure nor superior to the things you are "afraid" of.