Go 1.27 HTTP Router with Generic Methods and Zero-Alloc Routing: FURSY — What an Independent Audit Found at 94% Coverage

说明与用途

独立审计发现 FURSY 的 CORS 中间件错误地回显未过滤的头部，并且文档与实际 API 不符。修复后仅返回允许的头部，并添加了负面测试。文档已更新以匹配真实 API。

问题

An independent audit revealed critical security and documentation issues in the FURSY HTTP router, despite high test coverage and internal fixes.

结果

The audit uncovered a CORS header echo bug and documentation inaccuracies. Fixing the header logic and adding a negative test prevented potential security exposure. Documentation was cleaned to reflect real API capabilities.

工作流

• 1. Identify CORS bug: server echoed raw request headers instead of filtered list.
• 2. Modify setPreflightHeaders to use allowedHeaders instead of reqHeaders.
• 3. Add TestCORS_PreflightFilteredHeaders to test negative case.
• 4. Review documentation for inconsistencies and remove non‑existent API references.
• 5. Update docs to match actual API surface.

证据

The server should respond with only the headers it actually allows.

来源

headers.Set("Access-Control-Allow-Headers", reqHeaders) // BUG

来源

headers.Set("Access-Control-Allow-Headers", allowedHeaders) // FIXED

来源

The documentation was lying: router.Run(":8080") – method doesn’t exist

来源