Loading…
0+ curated questions with the same answer shape every time: quick recap, deep dive, pitfalls, and follow-ups. Coverage includes .
Application security interview questions for Go cover both the OWASP top 10 as they manifest in Go services and Go-specific security pitfalls. This module covers SQL injection in Go (why parameterised queries via database/sql are safe, the anti-pattern of fmt.Sprintf in query strings), XSS (Go's html/template package auto-escapes; text/template does not — the wrong template choice is a production XSS vulnerability), JWT in Go (golang-jwt/jwt v5 — the algorithm confusion attack, alg:none, how to enforce HS256/RS256, the Parse vs ParseWithClaims distinction), OAuth2 in Go (golang.org/x/oauth2 client, the PKCE flow for native apps), TLS configuration (tls.Config in Go — cipher suites, minimum TLS version, certificate validation), secrets management (environment variables, AWS Secrets Manager via aws-sdk-go-v2, HashiCorp Vault with the Go client), and input validation (go-playground/validator tags, the sanitize-never-trust model for user input in Go APIs). Go's type system prevents certain vulnerability classes but not all.
Full catalog
Topics are ordered for learning. Within each topic, rows are numbered 1–0 globally so you always know where you are. Collapse topics if you want a lighter view — use Expand all when you need the full list again.
Numbers 1–0 follow the order we recommend — click any row to open the full answer, or use the sticky Next link at the bottom of each page to go Q1 → Q0.