Sign inDemoInstall

Package Overview
File Explorer

Install Socket

Detect and block malicious and high-risk dependencies


Version published




A reasonably complete and well-tested golang port of Kenneth Reitz's httpbin service, with zero dependencies outside the go stdlib.

GoDoc Build status Coverage Docker Pulls



Docker images are published to Docker Hub:

# Run http server
$ docker run -P mccutchen/go-httpbin

# Run https server
$ docker run -e HTTPS_CERT_FILE='/tmp/server.crt' -e HTTPS_KEY_FILE='/tmp/server.key' -p 8080:8080 -v /tmp:/tmp mccutchen/go-httpbin


$ kubectl apply -k

See ./kustomize directory for further information

Standalone binary

Follow the Installation instructions to install go-httpbin as a standalone binary. (This currently requires a working Go runtime.)


# Run http server
$ go-httpbin -host -port 8081

# Run https server
$ openssl genrsa -out server.key 2048
$ openssl ecparam -genkey -name secp384r1 -out server.key
$ openssl req -new -x509 -sha256 -key server.key -out server.crt -days 3650
$ go-httpbin -host -port 8081 -https-cert-file ./server.crt -https-key-file ./server.key

Unit testing helper library

The package can also be used as a library for testing an application's interactions with an upstream HTTP service, like so:

package httpbin_test

import (


func TestSlowResponse(t *testing.T) {
	app := httpbin.New()
	testServer := httptest.NewServer(app)
	defer testServer.Close()

	client := http.Client{
		Timeout: time.Duration(1 * time.Second),

	_, err := client.Get(testServer.URL + "/delay/10")
	if !os.IsTimeout(err) {
		t.Fatalf("expected timeout error, got %s", err)


go-httpbin can be configured via either command line arguments or environment variables (or a combination of the two):

ArgumentEnv varDocumentationDefault
-allowed-redirect-domainsALLOWED_REDIRECT_DOMAINSComma-separated list of domains the /redirect-to endpoint will allow
-hostHOSTHost to listen on""
-https-cert-fileHTTPS_CERT_FILEHTTPS Server certificate file
-https-key-fileHTTPS_KEY_FILEHTTPS Server private key file
-max-body-sizeMAX_BODY_SIZEMaximum size of request or response, in bytes1048576
-max-durationMAX_DURATIONMaximum duration a response may take10s
-portPORTPort to listen on8080
-prefixPREFIXPrefix of path to listen on (must start with slash and does not end with slash)
-use-real-hostnameUSE_REAL_HOSTNAMEExpose real hostname as reported by os.Hostname() in the /hostname endpointfalse
-exclude-headersEXCLUDE_HEADERSDrop platform-specific headers. Comma-separated list of headers key to drop, supporting wildcard suffix matching. For example: "foo,bar,x-fc-*"-


  • Command line arguments take precedence over environment variables.
  • See Production considerations for recommendations around safe configuration of public instances of go-httpbin


To add go-httpbin to an existing golang project:

go get -u

To install the go-httpbin binary:

go install

Production considerations

Before deploying an instance of go-httpbin on your own infrastructure on the public internet, consider tuning it appropriately:

  1. Restrict the domains to which the /redirect-to endpoint will send traffic to avoid the security issues of an open redirect

    Use the -allowed-redirect-domains CLI argument or the ALLOWED_REDIRECT_DOMAINS env var to configure an appropriate allowlist.

  2. Tune per-request limits

    Because go-httpbin allows clients send arbitrary data in request bodies and control the duration some requests (e.g. /delay/60s), it's important to properly tune limits to prevent misbehaving or malicious clients from taking too many resources.

    Use the -max-body-size/MAX_BODY_SIZE and -max-duration/MAX_DURATION CLI arguments or env vars to enforce appropriate limits on each request.

  3. Decide whether to expose real hostnames in the /hostname endpoint

    By default, the /hostname endpoint serves a dummy hostname value, but it can be configured to serve the real underlying hostname (according to os.Hostname()) using the -use-real-hostname CLI argument or the USE_REAL_HOSTNAME env var to enable this functionality.

    Before enabling this, ensure that your hostnames do not reveal too much about your underlying infrastructure.

  4. Add custom instrumentation

    By default, go-httpbin logs basic information about each request. To add more detailed instrumentation (metrics, structured logging, request tracing), you'll need to wrap this package in your own code, which you can then instrument as you would any net/http server. Some examples:

  5. Prevent leaking sensitive headers

    By default, go-httpbin will return any request headers sent by the client (and any intermediate proxies) in the response. If go-httpbin is deployed into an environment where some incoming request headers might reveal sensitive information, use the -exclude-headers CLI argument or EXCLUDE_HEADERS env var to configure a denylist of sensitive header keys.

    For example, the Alibaba Cloud Function Compute platform adds a variety of x-fc-* headers to each incoming request, some of which might be sensitive. To have go-httpbin filter all of these headers in its own responses, set:


    To have go-httpbin filter only specific headers, you can get more specific:




Motivation & prior art

I've been a longtime user of Kenneith Reitz's original, and wanted to write a golang port for fun and to see how far I could get using only the stdlib.

When I started this project, there were a handful of existing and incomplete golang ports, with the most promising being ahmetb/go-httpbin. This project showed me how useful it might be to have an httpbin library available for testing golang applications.

Known differences from other httpbin versions

Compared to the original:

  • No /brotli endpoint (due to lack of support in Go's stdlib)
  • The ?show_env=1 query param is ignored (i.e. no special handling of runtime environment headers)
  • Response values which may be encoded as either a string or a list of strings will always be encoded as a list of strings (e.g. request headers, query params, form values)

Compared to ahmetb/go-httpbin:

  • No dependencies on 3rd party packages
  • More complete implementation of endpoints


Last updated on 18 Feb 2024

Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.


Related posts

SocketSocket SOC 2 Logo


  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc