go-safeweb
go-safeweb copied to clipboard
Add a plaintext type that is safe by default
It is currently possible to use the default dispatcher to write JSON, templated HTML and static HTML.
It would be beneficial to add one more type to allow text/plain strings to be written.
Should this be done using a custom (safehttp/safehtml?) type, or can we just use string
or even []byte
(providing a similar experience to net/http
), as long as we ensure the text/plain
content-type header is enforced?
A string
is IMHO a good choice, especially since we know that they're UTF-8 encoded and we can set the charset properly.
+1 on using strings. If we enforce a safe content-type it should be fine to serve any string.