Implementing Security Best Practices
1. Always Using TLS
| Rule | Detail |
|---|---|
| Production | Never insecure.NewCredentials() |
| Minimum | TLS 1.2; prefer 1.3 |
| Ciphers | Modern AEAD only |
2. Validating Certificates
| Check | Detail |
|---|---|
| Chain to trusted CA | Internal PKI or public CA |
| SAN matches | Server hostname |
| Not expired / not revoked | Honor CRL or OCSP |
Never InsecureSkipVerify | Outside of tests |
3. Implementing mTLS
| Aspect | Detail |
|---|---|
| Server requires client cert | ClientAuth: RequireAndVerifyClientCert |
| Identity from cert | SPIFFE ID or SAN |
| Use SPIRE / Istio | Automated rotation |
4. Using Strong Authentication
| Mechanism | Detail |
|---|---|
| OAuth2 / OIDC | Federated identity |
| mTLS | Service-to-service |
| Short-lived tokens | Minutes, not days |
| Avoid static API keys | Or rotate aggressively |
5. Implementing Authorization
| Layer | Detail |
|---|---|
| Method-level | Per-RPC allowlists |
| Resource-level | Owner / tenant scoping |
| Policy engine | OPA / Cedar |
| Default deny | Explicit allow only |
6. Validating Input
| Tool | Detail |
|---|---|
| protovalidate MODERN | CEL rules in .proto |
| Server interceptor | Reject before business logic |
| Length limits | Cap strings/repeated to avoid DoS |
7. Sanitizing Output
| Concern | Detail |
|---|---|
| Don't leak internals | Map internal errors → safe codes/messages |
| Redact PII | From responses meant for less-privileged callers |
| Strip stack traces | Never return to client |
8. Implementing Rate Limiting
| Layer | Detail |
|---|---|
| Per principal | Token bucket keyed on user/IP |
| Global | Protect backend capacity |
| Cost-based | Expensive RPCs cost more tokens |
9. Setting Reasonable Limits
| Limit | Detail |
|---|---|
| MaxRecvMsgSize | Cap inbound (e.g. 4–16 MB) |
| MaxConcurrentStreams | Per connection |
| ConnectionTimeout | Idle/age caps |
| Deadlines | Mandatory on every RPC |
10. Logging Security Events
| Event | Detail |
|---|---|
| Auth failures | Principal, IP, method, reason |
| Authz denials | Resource, action, policy |
| Rate-limit hits | Possible abuse signal |
| No secrets in logs | Tokens, keys never logged |
11. Performing Security Audits
| Activity | Detail |
|---|---|
| Dependency scan | govulncheck, Snyk, Dependabot |
| Static analysis | gosec, CodeQL |
| Pen test | External annual |
| Threat modeling | STRIDE per service |