Breeze v1.5.2 – OAuth2 Improvements

Releases
1

Hi Gophers :waving_hand:

I’ve just released Breeze v1.5.2, focusing on production-ready OAuth2 and middleware performance.

Supported providers:

  • Google

  • Microsoft

  • GitHub

  • Discord

Example:



app.Use(oauth2.New(oauth2.Config{
    Provider: oauth2.Google(),
    ClientID: "...",
    ClientSecret: "...",
}))

Security improvements

  • PKCE

  • State validation

  • ID Token nonce validation

  • Cookie session expiration validation

  • Replay attack protection

Example:



if tok.IDToken != "" {
    nonce, _ := idTokenNonce(tok.IDToken)

    if subtle.ConstantTimeCompare(
        []byte(nonce),
        []byte(fs.Nonce),
    ) != 1 {
        return ErrNonceMismatch
    }
}

Performance

Besides OAuth2, this release also includes:

  • True zero-allocation hot paths

  • Lower GC pressure

  • Optimized middleware execution

  • Automatic pruning in the rate limiter to prevent unbounded memory growth

I’d appreciate any feedback, benchmarks, or code reviews from the Go community.

Repository:

https://github.com/nelthaarion/breeze