Sure, the first two — adding headers and rate limiting — can be done in nginx. I like secure.Config, though, because I don't have to remember header names and m

Sure, the first two — adding headers and rate limiting — can be done in nginx. I like secure.Config, though, because I don't have to remember header names and make sure I wrote them correctly, as Go compiler will throw error if I mistype something (BTW, that's the reason there's Referer method in http.Request - http://golang.org/pkg/net/http/#Request.Referer http://golang.org/pkg/net/http/#Request.Referer). As for sessions, please do not use OpenResty's encrypted-session-nginx-module; check its issue tracker for examples of how not to do crypto: https://github.com/openresty/encrypted-session-nginx-module/issues https://github.com/openresty/encrypted-session-nginx-module/...