Right now if you import the x/net/trace package you wind up with the
side effect that net/http's DefaultServeMux has handlers for
/debug/requests and /debug/events registered on it. The only mention
of this side effect in the docs is a somewhat unclear statement right
at the start:
Package trace implements tracing of requests and long-lived objects. It exports HTTP interfaces on /debug/requests and /debug/events.
To me, this was very confusing. I did not take that statement to mean
that the package implicitly registers the handlers, but that this was
behavior you could achieve with the package (eg. maybe there's a
"RegisterHandlers" function that registers those two handlers).

I've put in a CL to make the documentation clearer
(https://go-review.googlesource.com/#/c/22208/1) but I'd also like to
propose that this "feature" be removed.

Implicitly setting up the handlers on package import violates Go's
principal of least suprise; in my case, that was just a panic and a
few minutes of me starting blankly at a screen wondering how the
handler I was registering could already be registered, but in someone
elses case it could involve a route to their debugging info being
exposed to the public (because they only thought to put authorization
or authentication in front of the /trace route which is where they
explicitly exposed the trace handler after importing this package).

In the elegant words of one of my coworkers when we discovered this
behavior: "that is a pretty gross side effect".


Sam Whited
pub 4096R/54083AE104EA7AD3

You received this message because you are subscribed to the Google Groups "golang-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-dev+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Search Discussions

Discussion Posts

Follow ups

Related Discussions

Discussion Navigation
viewthread | post
posts ‹ prev | 1 of 3 | next ›
Discussion Overview
groupgolang-dev @
postedApr 19, '16 at 4:33a
activeApr 19, '16 at 4:44a



site design / logo © 2022 Grokbase