Web Development With Go (Jon Calhoun)（Z-Library）

【One-Line Pitch】 A hands-on, project-driven guide to building a real web application in Go—routing, templates, databases, authentication, and security—for developers who know some Go and want to ship a working site rather than just study syntax. 【Book Arc】 - **Opening (~0%–10%)**: Bootstraps a minimal HTTP server, adds a custom router and 404 handling, and introduces the MVC mental model plus the request lifecycle. - **Early (~10%–32%)**: Builds the view layer with `html/template`, reusable Bootstrap layouts and named templates, then wires up the first controller and form processing with struct tags. - **Middle (~32%–48%)**: Introduces PostgreSQL and GORM, models users and orders, and refactors data access behind a `UserService` interface with query methods. - **Late (~48%–60%)**: Implements authentication—password hashing, login/logout flows, and the security reasoning behind each step. - **Ending (~60%+)**: Covers persistent sessions via remember tokens, HMAC signing, cookie hardening against XSS and theft, and CSRF prevention, closing with exercises. 【Key Takeaways】 - **The book teaches through one continuous project** (Opening): concepts arrive as features you add to a single app, so learning is cumulative rather than isolated snippets. - **Routing is built from scratch before frameworks** (Opening): understanding `HandlerFunc`, method matching, and path parsing makes later framework use less magical. - **`html/template` is a security choice, not just a convenience** (Early): its auto-escaping defends against code injection, unlike `text/template`. - **Reusable layouts and named templates keep views maintainable** (Early): a shared Bootstrap shell lets individual pages focus on content. - **Struct tags bridge forms, models, and databases** (Early): metadata like `schema` and `gorm` keys drives mapping without manual glue code. - **Data access belongs behind a service layer** (Middle): the `UserService` interface isolates queries and makes the rest of the app easier to reason about. - **Password handling requires deliberate separation** (Middle): storing a hash-only field and a non-persisted raw field prevents accidental double-hashing or plaintext leaks. - **Cookie security is layered** (Ending): HMAC signing detects tampering, while XSS, theft, and CSRF each need their own mitigation. 【Reading Tips】 - Deep-read the routing and template chapters; they underpin everything later and are where Go's standard library shines. - Skim the Bootstrap/CSS asides—they're about speed, not concepts—but don't skip the security boxes. - Treat the exercises (especially the "HARD" ones) as required; they force you to extend the service layer yourself. - When you hit GORM, pause to understand `AutoMigrate`'s limits before relying on it. - Keep the running app open in a browser as you read; the book is designed to be typed along with. 【Coverage Limits】 The excerpts cover roughly the first half of the book plus the authentication/session chapters; later deployment, testing, and any advanced topics are not represented here.