Go Backend Masterclass: Build Enterprise REST APIs

Explore how DNS resolution, IP addresses, and TCP handshake enable HTTP/HTTPS requests, and distinguish URL and URI components like scheme, host, port, path, and query.

Explore the request response cycle by showing how a client and server exchange HTTP requests and responses, covering methods, headers, DNS resolution, a three-way handshake, TLS handshake, and status codes.

Frontend development focuses on the client side, building user interfaces and experiences with HTML, CSS, JavaScript, and frameworks like React, Angular, and Vue.js, and connects to back-end APIs via HTTP.

Explore the server side, where the back end processes requests, manages data, and runs application logic via servers, databases, and APIs such as RESTful and GraphQL.

Explore the evolution of http from 1.0 to 3, highlighting persistent connections, multiplexing, header controls like host, if-modified-since, cache-control, and the move from tcp to quic with encryption over udp.

Choose Linux as the development environment for building enterprise rest APIs with Go. Enable Windows subsystem for Linux (wsl) on Windows to run Linux tools for benchmarking and requests.

Explore how an API enables application communication and how REST designs data exchange with stateless, client-server architecture, a uniform interface, and resource-based endpoints using HTTP methods.

Use go's net/http to create an http client, send get requests to json placeholder and star wars API, handle errors, read responses, and later build a server and API.

Master the net/http package to build a Go HTTP server, defining handlers and routes to process requests and send responses for enterprise REST APIs.

Understand how ports act as doors for external data, with 65,535 ports divided into well known, registered, and dynamic ranges, enabling services like http, https, smtp, and web apps.

Explore Postman for testing APIs, including gRPC support, cross-platform installation, login fixes on Linux, and sending requests to the Star Wars API and JSON placeholder for organized responses.

Install wrk, a versatile benchmarking tool, on macOS via homebrew (brew install wrk), Windows through WSL, and Linux with sudo apt-get install wrk to benchmark your enterprise rest APIs.

Learn how to install htop as an optional tool for benchmarking the api with RTK, and compare it to system monitors and task managers across macOS, Windows, and Linux.

Benchmark an API in Go against Node.js benchmarks, showing Go's high throughput and full CPU core utilization by default, while Node.js needs clustering to maximize performance across cores.

Master go modules and go mod init to organize code, manage external dependencies with a go.mod file, and understand modules vs packages for enterprise rest api development.

Discover how go get downloads third party packages and their dependencies, updates go.mod, and stores modules in the go workspace, improving portability and project cleanliness.

Build a Go server that supports HTTP/2 with HTTP 1.1 fallback over HTTPS, using net/http and http2, with development self-signed certificates and production TLS from certifying authorities.

Explore how tls and https rely on key.pem and cert.pem to prove server identity, manage private key and public key, encrypt data, and use pem format with certificate details.

Test a go backend api over tls and https, switching from http1 to http2. Diagnose tls handshake errors and self-signed certificates, and compare ssl verification in postman and browsers.

Explore using curl to test enterprise APIs, observe HTTP/2 and TLS versions, and diagnose TLS handshake issues, including ALPN negotiation and the impact of self-signed certificates.

Explore how http/2, https, and gRPC work, including tls handshake steps, certificate validation, session keys, and the security and performance benefits of tls 1.3.

Master mutual TLS and Postman certificate settings by diagnosing TLS handshake errors, validating certificates, generating keys with OpenSSL, and enforcing client authentication for secure Go APIs.

Benchmark http1 vs http2 with and without tls using go and h2load. Explore how tls overhead and http2 header compression affect throughput and traffic, with http1 sometimes outperforming http2 locally.

Explore JSON serialization and deserialization in Go, mastering marshal, unmarshal, and the new encoder and decoder for streaming, in-memory, and large data sets.

Organize a professional rest application programming interface project with a scalable folder structure, including cmd, internal, models, repository, pkg, and proto, to support planning, environment variables, and data access.

Plan and build a modular school api with separate endpoints for executives, teachers, and students. Implement jwt authentication, rate limiting, and robust input validation.

Create a school api with a go backend, spin up a server on port 3000, and define routes using http methods to illustrate crud operations.

Explore how to process API requests, handle form data and raw JSON, parse input with r.ParseForm and json.Unmarshal, and map inputs to models for storage.

Learn to implement path parameters in Go REST APIs using the standard library, from legacy extraction to the easier approach in Go 1.22, with modular route handlers and ID-based routing.

Learn how to use query parameters to filter and sort data in Go, extracting key values from the URL with the request object and Get method, and set default values.

Initialize a git repository at the project root and switch the branch to main. Use a dot gitignore to hide environment variables and confidential data, secret keys for jwt tokens.

Learn how the Go mux multiplexer routes http requests to multiple endpoints, enables grouping and middleware, and helps organize scalable APIs.

Go backend masterclass teaches how middleware acts as gatekeepers between requests and handlers, enabling logging, authentication, authorization, data validation, and error handling through chained wrappers.

Explore building a headers middleware in Go to harden rest APIs by setting dns prefetch, x frame options, xss protection, content type options, hsts, content security policy, and referrer policy.

Learn how cross-origin resource sharing and cors middleware secure your go api across origins. Configure allowed origins, set access-control headers, and handle preflight options to enable legitimate cross-origin requests.

Build a Go response time middleware that measures request duration from receipt to response, capturing status codes with a custom response writer and logging performance using x response time header.

Implement compression middleware in a Go web server that uses the accept encoding header to deliver gunzip or gzip responses, reducing payload sizes and bandwidth, and assess trade-offs for performance.

Implement an HTTP parameter pollution (HPP) middleware in Go that cleans query and body parameters, enforces a whitelist, and lets you keep the first or last value for duplicates.

Explore how to order middlewares for an enterprise Go API, using rate limiter, cors, security headers, response time, and compression to optimize request handling and response flow.

Create a reusable apply middlewares function to chain variadic middlewares for http handlers, using a custom middleware type, and verify order on the secure mux.

Explore the older routing technique used before go 1.22, preparing you to work with legacy codebases and upgrade to the modern go 1.22 routing features.

Build a Go API GET handler for teachers, supporting list, filter by first or last name, and get by id with path parameters, using an in-memory map and JSON responses.

Add a post handler to create single or multiple teachers using JSON decoding, mutex protection, and in-memory storage, returning a status and added data.

Split the Go backend into dedicated handlers for teachers, execs, and students, move the teacher model to models, and export routes and utilities for a cleaner, testable router.

MariaDB provides an open source, MySQL-compatible relational database management system with high performance and security. It supports multiple storage engines, replication, and clustering for high availability.

Install and secure MariaDB on linux using the apt package manager, set the root password, remove anonymous users, disable remote root login, and verify service status.

Install and use DBeaver or phpMyAdmin as MariaDB GUI tools. Connect to MariaDB or MySQL on port 3306, test the connection, and manage your databases.

Master core CRUD operations in MariaDB via the command line, including starting the server, creating databases and tables, inserting, querying, updating, and deleting records.

Explore how to set up a MariaDB database in DBeaver, create tables with primary keys and auto increment, and perform CRUD operations using GUI and SQL.

Connect a Go API to MySQL or MariaDB by setting up a sql connect function, using the MySQL driver with an underscore import, and test the database connection.

Understand how the dot env file manages environment variables for api development, storing database credentials, api keys, secret keys, and ports to keep secrets out of code.

Create the school database and a teachers table with id, first_name, last_name, email (unique), class, and subject, set id to auto_increment starting at 100, and index the email.

Teach how to move post operations to a database-backed insert, using prepared statements, handling errors, retrieving last insert id, and returning a json response with created status.

Fetch a single teacher by id from the database with a select query, scanning id, first name, last name, email, class, and subject; return 404 if not found.

Update the get teachers handler to return multiple teachers by querying the database with optional first name and last name filters, and scan results into a list.

Learn how where 1=1 serves as a placeholder for dynamic query building in Go, enabling flexible filters for first name, last name, and other fields.

Enable advanced filtering by any field using a dynamic query parameter map, build conditional query strings, and refactor into addFilters to reduce duplication; plan to add sorting next.

Develop a multi-criteria sorting feature for a Go backend API using sort parameters and order by, supporting ascending or descending and multiple fields via square bracket query.

Learn how to implement the put method to fully replace a teacher record, handle id extraction, decode JSON, and update the database.

Learn to implement a patch handler that updates only the provided fields using a map, avoiding blank replacements and partial updates in Go backend APIs.

Improve patch handling by using reflect to update any number of struct fields based on json tags. This dynamic approach enables type-aware updates and scales for enterprise rest apis.

Identify the teacher by id, delete the record from the teachers table via sql, and return a json response with status and id.

Learn how Go 1.22 introduces method-based routing and easier path parameter extraction to modernize enterprise REST APIs, replacing the older routing technique and clarifying go.mod version requirements.

Refactor the mux router to leverage Go language features, implementing get, post, put, patch, and delete for teachers; ensure proper path parameter routing and single-space syntax.

Use path parameters to fetch a single teacher by id, refactor get handlers for single and multiple entries, and extract the path value for database access.

Implement a patch teachers endpoint that updates multiple entries from a JSON list, using a transaction to ensure all-or-nothing updates, with reflection-based field updates and robust error handling.

Implement a delete multiple teachers endpoint using a transaction and prepared statements to delete IDs, track deleted IDs, and gracefully handle non-existent IDs and errors.

Define models to structure and validate data, serving as an abstraction between database and application logic in Go, with camelCase and tags for JSON and db.

Refactor your Go backend by extracting database operations into a dedicated SQL connect package, making teacher handlers concise, modular, and easier to test.

Go error handling by developing a centralized system with a utils error handler and a custom logger. Log detailed errors server-side while returning generic messages to clients.

Learn how db tags map struct fields to database columns, compare manual SQL with orm options like gorm, and build custom reflection-based query utilities for a REST API.

Go backend data validation helps you ensure incoming data meets format, presence, type, and range requirements, with server-side validation, meaningful error messages that guide users, and safe database interactions.

Create a students table with id, first name, last name, email, and class, linking to teachers via class, and enable crud operations by indexing class in teachers.

Set up the students route with a get handler returning a welcome message, replicate and rename the teachers crud for students, and enable sorting and filters with shared utils.

Test the students API routes end-to-end by creating test data, addressing foreign key constraints, and validating GET, POST, PUT, PATCH, and DELETE operations with Postman.

Add new subroutes to the teachers handler to fetch each class teacher's student count and the list of students, using get requests for teachers/{id}/students and teachers/{id}/studentcount, and avoid nil handlers.

Develop and test the get students by teacher id endpoint that queries the database, scans rows, builds a students list, and returns status, count, and data with proper error handling.

Develop a dedicated student count endpoint using teacher ID, employing a SQL count with a subquery to determine class and return an integer count.

Refactor and modularize your Go router by creating sub routers for teachers and students, extracting routes into separate files, and wiring them with a shared http server mux.

Implement an execs router using a new mux to handle login, logout, forgot password, reset password, and update password routes, with exec-specific get, post, patch, and id-based paths.

Design an execs model and database table in Go, including nullable fields with sql.NullString, unique indices on email and username, and enable CRUD for enterprise REST APIs.

Develop and test a complete execs crud api in go, implementing get, add, patch, and delete routes with execs model, json/db tags, and database queries.

Secure password hashing for an enterprise REST API using bcrypt, pbkdf2, and Argon2id with salt and base64 encoding, storing only hashed passwords and not plain text.

Authenticate users by verifying identity with credentials or tokens, including JSON web tokens and multi-factor methods. Authorize actions via RBAC, ABAC, and ACLs, enforcing least privilege and regular reviews.

Understand cookies, sessions, and JWTs in REST APIs. See how cookies carry session IDs, how servers manage sessions, and how JWTs authenticate users with claims.

Implement a login handler that validates input, looks up the user by username, verifies active status and password, then generates a JWT token to return or set as a cookie.

Check user activity and return forbidden if inactive; verify password by parsing a base64 salt and hash, decoding them, hashing with Argon2, and comparing in time before issuing a JWT.

Develop a login route that issues a JWT, returns it in the response, and stores it as a secure http-only cookie for 24 hours with id, name, and role.

Refactor the login route by extracting the database access into get user by username and adding a dedicated password verification in password.go to improve readability and security.

Implement a logout handler in a Go REST API by clearing the JWT cookie, optionally blacklisting tokens, and ensuring the client cannot reuse the token to access protected resources.

Create a jwt authentication middleware to protect all api endpoints by verifying tokens from cookies, parsing claims like role and user id, handling expired tokens, and propagating user context downstream.

Learn to skip jwt middleware on selected routes by building an exclude routes helper, enabling login via pre-login, and securing the rest of the API with bearer tokens.

Learn to implement a secure update password flow in a Go backend: validate input, verify current password, hash and store the new password, update password_changed_at, and optionally issue a token.

Implement a forgot password flow and test email delivery with Mail Hog, a go-based SMTP server and web interface that captures reset emails for safe development.

Implement a forgot password handler that validates the email, generates a reset token with expiry from env, updates the user record, and sends the reset link via Go Mail.

Go backend reset password flow validates new and confirm passwords, decodes the reset token, hashes the new password, and updates the database while nullifying token fields.

Explore how CSRF tricks authenticated web apps, and how APIs with tokens mitigate risk through same-site cookies, double-submit cookies, custom headers, and CSRF tokens.

Apply pagination to the Go api by using page and limit on the students route, with offset calculation, total count, and a reusable function ready for teachers and exact routes.

Learn to protect APIs from XSS and injections by implementing a Go XSS middleware with data sanitization, escaping, and whitelist filtering using Blue Monday.

Implement role-based authorization by extracting the user role from the request context. Enforce access on admin, manager, and exec routes using the utils.authorizeUser function.

Obfuscate code to deter reverse engineering while preserving functionality, protecting intellectual property and API security. Exercise caution about performance overhead and maintainability, and pair obfuscation with other security measures.

Embed dot env with go embed into final binary, then load its environment variables with go dot env so the API obtains the certificate and key paths for production.

Build go binaries for linux and windows with go build, using go os and go arch; load env vars from dot env files and test tls, non-tls, http/2, and middleware.

Benchmark your Go backend APIs by comparing TLS with middleware across HTTP/2 and HTTP/1.1, with and without obfuscation, and against source code versus binary, to assess performance and overhead.

Master go for enterprise rest APIs by mastering concurrency, native MariaDB connections without ORM, custom middleware, advanced routing with mux, and authentication from scratch.

Master the Go backend stack by building a pure Go rest API without third-party libraries, then extend to gRPC with TLS, protobufs, MongoDB CRUD, tested with Postman and GTS.

Apply Go and gRPC to practical API projects, start small with a billing or library management API, and build a professional portfolio through open source contributions and hands on coding.

Develop deep go expertise through practical, hands-on learning and theoretical understanding to confidently tackle enterprise tasks, unlock high-paying roles, and build a solid foundation for innovative, throughput-focused Go-backed systems.