Web services and REST APIs with Go
You build a production-ready REST API that routes with the standard library, writes safely to SQLite, authenticates users and logs in a structured way.
Level 301 · 21 lessons · 18 practice labs
Lessons
API design
- REST design: resources, methods and status codes
- The Go 1.22 ServeMux: method and path patterns
- Decoding JSON requests and writing responses
- Input validation and consistent error responses
- Pagination, filtering and sorting
- Short task: a small in-memory notes API
Database
- Connecting to SQLite with database/sql
- Parameterised queries and SQL injection
- Transactions and rolling back on error
- Schema migrations and versioning
- A repository layer: separating handlers from the database
- Short task: move the notes API onto SQLite
Identity, logging and operations
- Storing passwords: bcrypt and argon2
- Session cookies or signed tokens?
- Verifying JWTs correctly: algorithm and expiry pitfalls
- Authorisation: an ownership check on every record
- Structured logging with slog
- Configuration and secrets from the environment
- End-to-end tests for the API
- Short task: add an audit log of who changed what
Capstone
- Capstone: an asset inventory API with authentication
Practice labs
- Defining note routes with ServeMux patterns: Define list, get, create and delete routes with the method and path patterns of the Go 1.22 ServeMux and read the path value with PathValue.
- Decoding a JSON request strictly: Read the body with a size limit, reject unknown fields and trailing data and return the right status code on errors.
- Fixing wrong status codes: In an API that returns 200 for everything, map creation, not-found, conflict and validation cases to the right codes and test them all with an httptest table.
- Validating a booking request: Validate date, party size and e-mail fields and return all field errors in one response rather than stopping at the first.
- Gathering API errors into one envelope: Gather errors returned as plain text in some places and JSON in others into one envelope with code, message and request id.
- Making pagination and sorting safe: Cap the page size, pick the sort field from an allow-list and move to cursor pagination, testing that no record is skipped during inserts.
- Turning a SQL search into one with placeholders: Turn a search query built with fmt.Sprintf into one with placeholders and test that a search containing quotes works properly.
- Doing a stock transfer inside a transaction: Do a stock transfer between two warehouses in one transaction, roll back if the second step fails and show the total stock is preserved.
- Curing pool exhaustion from unclosed result sets: Find the unclosed Rows and unchecked rows.Err uses in an API that locks up under load, fix them and show the pool statistics stay balanced.
- Applying a schema migration with a version table: Complete a small runner that applies migration files in order and records them in a version table so a second run does nothing.
- Separating handlers from the database: Move the SQL in the handlers behind a repository interface and run the handler tests with an in-memory fake repository.
- Moving an in-memory API onto SQLite: Move an in-memory task API onto a SQLite repository and show both stores pass the same contract tests with no lost writes under concurrency.
- Storing passwords with bcrypt: Convert passwords stored as plain SHA-256 to bcrypt, write the verification function and test the same password yields different hashes.
- Closing the gaps in JWT verification: Fix a token verification that checks neither algorithm nor expiry and show with tests that unsigned, wrong-algorithm and expired tokens are rejected.
- Checking ownership on every record: Find the endpoints in Sedirli Hukuk Bürosu's case API that return, update and delete another user's record, move the check into the repository layer and add regression tests.
- Structured request logging with slog: Add slog middleware that writes method, path, status and duration as JSON for every request and mask the password field.
- Taking settings and secrets from the environment: Move the hard-coded database path and signing key to environment variables and stop at start-up with a clear error when a required value is missing.
- Testing a who-changed-what audit log end to end: Write changes with user, old and new value to an audit table in the same transaction and add end-to-end tests with httptest covering login, change and the audit check.
About this course
You build a production-ready REST API that routes with the standard library, writes safely to SQLite, authenticates users and logs in a structured way.
What you will learn
- API design
- Database
- Identity, logging and operations
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.