search

google / go-safeweb

Secure-by-default HTTP servers in Go.
Apache License 2.0
1.43k stars 81 forks source link

(*safehttp.Config).Mux() is not safe for concurrent use #331

Closed empijei closed 3 years ago

empijei commented 3 years ago

Currently running tests that use safehttp in parallel is impossible because Mux() writes to freezeLocalDev without locks:

https://github.com/google/go-safeweb/blob/697f59a9d57f76ec8631ac1d3181bbfd1ebaeb45/safehttp/mux.go#L171-L175

We should make this safe to use concurrently, together with IsLocalDev