httpclient

gitlab.com/phpboyscout/go/httpclient builds a secure-by-default *http.Client: a TLS 1.2 floor with curated cipher suites (from go/tls), sane connection limits and timeouts, and a redirect policy that refuses HTTPS→HTTP downgrades. Layer on the client middleware from go/transit — retry with backoff, circuit breaking, host-pinned credentials, request logging — through simple options.

It is the client half of the transport stack extracted from go-tool-base: a service or library that only makes outbound HTTP calls gets the hardened client and its middleware without ever linking the server stack (controls, authn, gateway) or the gRPC SDK.

Install

go get gitlab.com/phpboyscout/go/httpclient

Quick start

package main

import (
	"time"

	"gitlab.com/phpboyscout/go/httpclient"
	transithttp "gitlab.com/phpboyscout/go/transit/http"
)

func main() {
	client := httpclient.NewClient(
		httpclient.WithTimeout(10*time.Second),
		httpclient.WithRetry(transithttp.DefaultRetryConfig()),          // retry transient failures
		httpclient.WithClientMiddleware(transithttp.NewClientChain(      // per-request middleware
			transithttp.WithBearerToken("…"),
		)),
	)

	resp, err := client.Get("https://api.internal/things")
	_ = resp
	_ = err
}

Design

• Framework-free. Depends only on go/tls, go/transit and cockroachdb/errors (plus transit's OTel/redact transitive deps). A depfootprint_test.go guard forbids go-tool-base, the server stack (controls/authn/gateway), the gRPC SDK, Viper/Cobra/ Charm and the cloud SDKs.
• Secure by default. Hardened TLS, connection limits, and a CheckRedirect that caps redirects and rejects HTTPS→HTTP downgrades — you opt out, not in.
• Middleware is transit's. Retry, circuit breaking, auth and logging are the go/transit client round-trippers; this module just wires them into NewClient.

Compatibility

go/transit and go/tls versions are pinned and kept in lockstep with go-tool-base. Grouped Renovate updates keep them aligned.

What it does not do

No HTTP/2 negotiation, no cookie jar, no retry of non-idempotent methods, no configuration keys or environment variables of its own, and no response-body limit. Each absence, and what to do instead, is in what httpclient does not do.

Documentation

Guides, options and the factory model: httpclient.go.phpboyscout.uk — including every client option and its default and what NewClient and NewTransport set. API reference: pkg.go.dev.

License

See LICENSE.