0.6 The Go labs: build the lifecycle yourself
Chapters 14–25 each include a "Build it in Go" section: a complete program, built only on Go's standard library, that turns the chapter into something you can run against real sites and break on purpose. Every lab was run while writing this guide, and the outputs shown are real.
Setup: install Go 1.22+ (brew install go, or go.dev/doc/install), then:
mkdir -p ~/httpslabs && cd ~/httpslabs && go mod init httpslabs
mkdir httptrace # save the lab as httptrace/main.go
go run ./httptrace https://example.com/
If you haven't used Go's net package before, read
TCP/IP guide §0.8 first. It maps each Go call to the system
calls and packets underneath.
| Lab | Chapter | What you build |
|---|---|---|
protoprobe |
14 | Which HTTP versions a site offers, via ALPN, Alt-Svc, and the DNS HTTPS record |
edgecache |
15 | A mini CDN edge: Cache-Control, Vary, ETag/304, stale-while-revalidate |
certcheck |
16 | A certificate inventory scanner with expiry thresholds, chain checks, and CT lookup |
httptrace |
17 | curl -w in Go: per-phase timing, connection reuse, path headers |
httpsserver |
19 | A production-shaped HTTPS server: TLS, timeouts, security headers, graceful shutdown |
slowloris |
19 | A loopback-only demonstration of why server timeouts matter |
revproxy |
20 | A path-routing reverse proxy: X-Forwarded-For done right, 502 vs 504 |
desync |
20 | Request smuggling's root cause, reproduced safely |
resilience |
21 | Rate limiting, idempotency keys, retries with budgets, a circuit breaker |
ssrfguard |
22 | An HTTP client that is safe to point at user-supplied URLs |
slo |
23 | SLIs, error budgets, and multi-window burn-rate alerts |
sse |
24 | Server-Sent Events with heartbeats, resume, and the WriteTimeout trap |
walkthrough |
25 | One HTTPS request through every layer, each step labelled with the guide that explains it |