
`http.Get` and `http.Post` are convenience functions backed by the package-level `http.DefaultClient`. For production use, create an explicit `http.Client` with a timeout so slow servers cannot hold goroutines open forever.

<ExamplePair>
<ExampleProse>

`http.Get` makes a GET request and returns a `*http.Response`. Always read the full body and close it - even if you discard the content - to allow connection reuse by the underlying transport.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    resp, err := http.Get("https://httpbin.org/get")
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, err := io.ReadAll(resp.Body)
    if err != nil {
        panic(err)
    }
    fmt.Printf("status: %s\n", resp.Status)
    fmt.Printf("body: %s\n", body)
}
```

</ExampleCode>
</ExamplePair>

<ExamplePair>
<ExampleProse>

`http.NewRequestWithContext` creates a request tied to a context. Pass the context from the caller so that timeouts and cancellations propagate correctly through the full call chain.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "context"
    "fmt"
    "io"
    "net/http"
    "time"
)

func main() {
    client := &http.Client{Timeout: 5 * time.Second}

    ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
    defer cancel()

    req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://httpbin.org/delay/1", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Accept", "application/json")
    req.Header.Set("Authorization", "Bearer my-token")

    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("request failed:", err)
        return
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Printf("status: %d, body length: %d\n", resp.StatusCode, len(body))
}
```

</ExampleCode>
</ExamplePair>

<InProduction>
Always set a `Timeout` on `http.Client` - the zero value has no timeout and will hold a goroutine and a TCP connection open forever on a slow or unresponsive server. This has caused countless production incidents where a downstream service degradation cascaded into goroutine exhaustion in the caller. Always read and close `resp.Body` even when you do not need the content: failing to drain the body prevents the underlying TCP connection from returning to the pool, forcing a new connection for every request. Use `http.NewRequestWithContext` and pass a context derived from the incoming request so that if the upstream caller cancels (client disconnects, gateway times out), the outbound call also cancels. For services making many outbound calls, configure the `http.Transport` directly: increase `MaxIdleConnsPerHost` to match your concurrency, and set `DisableKeepAlives: false` (the default) to reuse connections. Closing the transport is rarely correct - share one client across the lifetime of the service.
</InProduction>


Always set Timeout on http.Client - the zero-value client has no timeout and holds goroutines open indefinitely when a downstream server is slow or unresponsive.

HTTP Client


`http.ListenAndServe` starts an HTTP server using the package-level default mux and a zero-value server with no timeouts. For production use, construct `http.Server` explicitly so you control timeouts and can implement graceful shutdown.

<ExamplePair>
<ExampleProse>

Register handlers with `http.HandleFunc` (pattern, handler) or create a custom `http.ServeMux`. Go 1.22 added method and path-parameter syntax (`GET /users/{id}`) to the standard mux.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "fmt"
    "net/http"
)

func main() {
    mux := http.NewServeMux()

    mux.HandleFunc("GET /", func(w http.ResponseWriter, r *http.Request) {
        fmt.Fprintln(w, "hello, world")
    })

    // Go 1.22 path parameters: {id} is captured in r.PathValue("id")
    mux.HandleFunc("GET /users/{id}", func(w http.ResponseWriter, r *http.Request) {
        id := r.PathValue("id")
        fmt.Fprintf(w, "user: %s\n", id)
    })

    mux.HandleFunc("POST /users", func(w http.ResponseWriter, r *http.Request) {
        w.WriteHeader(http.StatusCreated)
        fmt.Fprintln(w, "created")
    })

    http.ListenAndServe(":8080", mux)
}
```

</ExampleCode>
</ExamplePair>

<ExamplePair>
<ExampleProse>

Construct `http.Server` explicitly to set timeouts, then implement graceful shutdown by listening for OS signals and calling `server.Shutdown`. In-flight requests are allowed to complete before the server stops accepting new connections.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "context"
    "fmt"
    "net/http"
    "os"
    "os/signal"
    "syscall"
    "time"
)

func main() {
    mux := http.NewServeMux()
    mux.HandleFunc("GET /health", func(w http.ResponseWriter, r *http.Request) {
        fmt.Fprintln(w, "ok")
    })

    server := &http.Server{
        Addr:         ":8080",
        Handler:      mux,
        ReadTimeout:  5 * time.Second,
        WriteTimeout: 10 * time.Second,
        IdleTimeout:  120 * time.Second,
    }

    // Start serving in a goroutine
    go func() {
        fmt.Println("listening on :8080")
        if err := server.ListenAndServe(); err != http.ErrServerClosed {
            fmt.Fprintf(os.Stderr, "server error: %v\n", err)
            os.Exit(1)
        }
    }()

    // Block until SIGINT or SIGTERM
    quit := make(chan os.Signal, 1)
    signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
    <-quit

    // Give in-flight requests up to 30s to complete
    ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
    defer cancel()
    if err := server.Shutdown(ctx); err != nil {
        fmt.Fprintf(os.Stderr, "shutdown error: %v\n", err)
    }
    fmt.Println("server stopped")
}
```

</ExampleCode>
</ExamplePair>

<InProduction>
Always use `http.Server` explicitly rather than `http.ListenAndServe` - the convenience function creates a zero-value server with no timeouts, which is vulnerable to slowloris attacks (a client sends headers one byte per second, holding the connection open indefinitely) and connection exhaustion. Set `ReadTimeout` to limit how long the server waits for a complete request, `WriteTimeout` to limit the response write phase, and `IdleTimeout` to reclaim keep-alive connections from idle clients. For graceful shutdown, call `server.Shutdown(ctx)` in response to `SIGTERM` - Kubernetes sends `SIGTERM` before `SIGKILL` and waits `terminationGracePeriodSeconds` (default 30s). `Shutdown` stops accepting new connections, waits for active handlers to return, then closes the listener - returning `nil` on success. If handlers block indefinitely (missing context propagation), `Shutdown` will wait until the context deadline fires and then return an error, so make sure every handler respects context cancellation on slow paths.
</InProduction>


Use http.Server explicitly with ReadTimeout, WriteTimeout, and IdleTimeout - the zero-value server has no timeouts and is vulnerable to slowloris and connection exhaustion.

HTTP Server


`log/slog` (introduced in Go 1.21) is the standard structured logging package. It replaces ad-hoc `log.Printf` calls with key-value pairs that log aggregators can index and query.

<ExamplePair>
<ExampleProse>

`slog.Info`, `slog.Error`, `slog.Debug`, and `slog.Warn` are the four level functions. Each accepts a message and alternating key-value pairs. The default handler writes human-readable text to stderr.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "log/slog"
    "os"
)

func main() {
    slog.Info("server starting", "port", 8080, "env", "production")
    slog.Debug("cache miss", "key", "user:42")  // filtered if level > Debug
    slog.Warn("rate limit approaching", "remaining", 10)
    slog.Error("database unreachable", "host", "db.internal", "err", os.ErrDeadlineExceeded)
}
```

</ExampleCode>
</ExamplePair>

<ExamplePair>
<ExampleProse>

Switch to a JSON handler for production. Use `slog.With` to create a child logger with pre-attached fields - every log line emitted from that logger includes those fields automatically.

</ExampleProse>
<ExampleCode>

```go
package main

import (
    "log/slog"
    "os"
)

func main() {
    // JSON handler for structured output (log aggregators expect this)
    logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{
        Level: slog.LevelInfo,
    }))
    slog.SetDefault(logger)

    // Attach request-scoped fields once; every subsequent log includes them
    reqLogger := logger.With("request_id", "abc-123", "user_id", 42)
    reqLogger.Info("request received", "method", "GET", "path", "/api/users")
    reqLogger.Info("request complete", "status", 200, "duration_ms", 14)
}
```

</ExampleCode>
</ExamplePair>

<InProduction>
Use `log/slog` for all new code - it is the stdlib answer to zerolog and zap for most workloads. Structured logs (JSON) are required for log aggregators like Datadog, CloudWatch Logs, and Grafana Loki; a `log.Printf` string line is effectively unsearchable at scale. Use `slog.With` to attach request-scoped fields (trace ID, user ID, tenant ID) at the handler entry point so every log line in a request includes them without threading the logger through every function call. Set the minimum level via `slog.HandlerOptions.Level` - debug logs in production are a compliance risk (they may contain PII or secrets) and a throughput risk (log volume can exceed ingestion limits under load). For high-throughput services where slog's allocation overhead is measurable, zerolog or zap remain valid choices, but profile first. Never log sensitive fields (passwords, tokens, full credit card numbers) at any level; redact at the point of construction.
</InProduction>


log/slog (Go 1.21) provides structured logging with JSON output for production and human-readable text output for development - attach request-scoped fields with slog.With.