mir-backend-go-echo
SolidMake It Right (Echo module). Echo web framework reliability augmentation for Go backends, covering Echo v5 (current) and v4 (maintained). Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Echo library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: echo.Context comes from a sync.Pool and must never be retained past the handler or handed to a goroutine; the v4->v5 rewrite that AI mixes up (Context became a *echo.Context struct, Logger became *slog.Logger, HTTPErrorHandler's arguments swapped, e.Shutdown and e.Close removed in favour of StartConfig); Bind never validates, so a missing c.Validate ships unchecked input, and Bind merges path and query values into one struct, a mass-assignment path; middleware ordering and graceful shutdown; and Echo's insecure defaults - c.RealIP() trusts X-Forwarded-For unless IPExtractor is set, and middleware.Secure sends no HSTS or CSP. TRIGGER only when the Go backend uses the Echo framework - building, reviewing, or debuggi
Install
Quality Score: 81/100
Skill Content
Details
- Author
- anantbhandarkar
- Repository
- anantbhandarkar/make-it-right
- Created
- 3 months ago
- Last Updated
- 1 weeks ago
- Language
- Python
- License
- Apache-2.0
Integrates with
Similar Skills
Semantically similar based on skill content — not just same category
mir-backend-go
Make It Right (Go runtime tier). Go 1.25/1.26 runtime reliability footguns shared across every Go backend framework (Gin, Fiber, Echo, chi, stdlib net/http) — distinct from the generic backend gates and from any one framework's mechanics. Covers: goroutine leaks (the #1 Go reliability bug) and the runtime goroutineleak profile, context propagation and cancellation, data races and `go test -race`, channel ownership rules, goroutine-level panic recovery, the nil-interface/nil-pointer trap, defer-in-loop resource buildup, slice aliasing, error wrapping with errors.Is/As/AsType, sync.WaitGroup.Go, the Go 1.22 per-iteration loop-variable change and its go.mod gating, deterministic concurrency tests with testing/synctest, container-aware GOMAXPROCS, log/slog structured logging, and Go-level security mechanics (http.Server timeouts, net/http CrossOriginProtection, os.Root path containment, SSRF dialer control, module checksum verification, govulncheck). TRIGGER when the backend runtime is Go — sits between mir-backe
mir-backend-go-gin
Make It Right (Gin module). Gin web framework reliability augmentation for Go backends. Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Gin library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: *gin.Context is request-scoped and pooled, so it must be copied with c.Copy() before any spawned goroutine touches it; passing *gin.Context as a context.Context silently drops cancellation unless engine.ContextWithFallback is set; binding and validation discipline (ShouldBindJSON, binding tags, a separate request struct, EnableDecoderDisallowUnknownFields); middleware ordering and graceful shutdown wiring (http.Server.Shutdown on SIGTERM); and Gin's insecure defaults - SetTrustedProxies defaults to 0.0.0.0/0 so c.ClientIP() is attacker-controlled, and gin-contrib/cors will emit credentials with a reflected origin. TRIGGER only when the Go backend uses the Gin framework - building, reviewing, or debugging a Gin handler, middleware, or router. SKIP for Fiber (mir-ba
mir-backend-go-fiber
Make It Right (Fiber module). Fiber web framework reliability augmentation for Go backends, covering Fiber v3 (current) and v2 (still patched). Chains: mir-backend (generic gates) -> mir-backend-go (Go runtime) -> this (Fiber library mechanics). Adds the mechanical footguns the runtime-agnostic tiers omit: fiber.Ctx and every value read from it (Body, Params, Query, Headers) are pooled and reused after the handler returns, so retaining them corrupts or discloses another request's data; the v2->v3 API rewrite that AI mixes up (Ctx is now an interface, BodyParser became c.Bind().Body(), c.Context() returns a context.Context, TrustedProxies became TrustProxyConfig); c.Bind() silently skips validation when fiber.Config.StructValidator is nil; fasthttp's incompatibility with net/http middleware; and graceful shutdown via ListenConfig.GracefulContext or app.ShutdownWithContext, which hangs on keep-alive connections when ReadTimeout is 0. TRIGGER only when the Go backend uses the Fiber framework - building, reviewin