Go 1.27 HTTP Router with Generic Methods and Zero-Alloc Routing: FURSY — What an Independent Audit Found at 94% Coverage

Description and use

An independent audit uncovered a CORS header echo bug and documentation inaccuracies in FURSY. The fix returned only allowed headers and added a negative test. Documentation was corrected to match the real API.

Problem

An independent audit revealed critical security and documentation issues in the FURSY HTTP router, despite high test coverage and internal fixes.

Outcome

The audit uncovered a CORS header echo bug and documentation inaccuracies. Fixing the header logic and adding a negative test prevented potential security exposure. Documentation was cleaned to reflect real API capabilities.

Workflow

• 1. Identify CORS bug: server echoed raw request headers instead of filtered list.
• 2. Modify setPreflightHeaders to use allowedHeaders instead of reqHeaders.
• 3. Add TestCORS_PreflightFilteredHeaders to test negative case.
• 4. Review documentation for inconsistencies and remove non‑existent API references.
• 5. Update docs to match actual API surface.

Evidence

The server should respond with only the headers it actually allows.

Source

headers.Set("Access-Control-Allow-Headers", reqHeaders) // BUG

Source

headers.Set("Access-Control-Allow-Headers", allowedHeaders) // FIXED

Source

The documentation was lying: router.Run(":8080") – method doesn’t exist

Source