Implementing Security Best Practices

1. Always Using TLS

Rule	Detail
Production	Never insecure.NewCredentials()
Minimum	TLS 1.2; prefer 1.3
Ciphers	Modern AEAD only

2. Validating Certificates

Check	Detail
Chain to trusted CA	Internal PKI or public CA
SAN matches	Server hostname
Not expired / not revoked	Honor CRL or OCSP
Never InsecureSkipVerify	Outside of tests

3. Implementing mTLS

Aspect	Detail
Server requires client cert	ClientAuth: RequireAndVerifyClientCert
Identity from cert	SPIFFE ID or SAN
Use SPIRE / Istio	Automated rotation

4. Using Strong Authentication

Mechanism	Detail
OAuth2 / OIDC	Federated identity
mTLS	Service-to-service
Short-lived tokens	Minutes, not days
Avoid static API keys	Or rotate aggressively

5. Implementing Authorization

Layer	Detail
Method-level	Per-RPC allowlists
Resource-level	Owner / tenant scoping
Policy engine	OPA / Cedar
Default deny	Explicit allow only

6. Validating Input

Tool	Detail
protovalidate MODERN	CEL rules in .proto
Server interceptor	Reject before business logic
Length limits	Cap strings/repeated to avoid DoS

7. Sanitizing Output

Concern	Detail
Don't leak internals	Map internal errors → safe codes/messages
Redact PII	From responses meant for less-privileged callers
Strip stack traces	Never return to client

8. Implementing Rate Limiting

Layer	Detail
Per principal	Token bucket keyed on user/IP
Global	Protect backend capacity
Cost-based	Expensive RPCs cost more tokens

9. Setting Reasonable Limits

Limit	Detail
MaxRecvMsgSize	Cap inbound (e.g. 4–16 MB)
MaxConcurrentStreams	Per connection
ConnectionTimeout	Idle/age caps
Deadlines	Mandatory on every RPC

10. Logging Security Events

Event	Detail
Auth failures	Principal, IP, method, reason
Authz denials	Resource, action, policy
Rate-limit hits	Possible abuse signal
No secrets in logs	Tokens, keys never logged

11. Performing Security Audits

Activity	Detail
Dependency scan	govulncheck, Snyk, Dependabot
Static analysis	gosec, CodeQL
Pen test	External annual
Threat modeling	STRIDE per service