gRPC-Go 1.84

Last reviewed Oct 18, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Go 1.27130 lines · 5.5K tokens
  2. gRPC-Go 1.8459 lines · 3.5K tokens
Total189 lines · 9K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 78
  • 79
  • 89
  • 94
  • 117
  • 190
  • 201
  • 203
  • 208
  • 209
  • 250
  • 252
  • 257
  • 287
  • 295
  • 306
  • 307
  • 319
  • 323
  • 327
  • 338
  • 347
  • 352
  • 362
  • 367
  • 378
  • 409
  • 426
  • 444
  • 488
  • 494
  • 532
  • 732
  • 759
  • 770
  • 772
  • 807
  • 862
  • 863
  • 915
  • 916
  • 918
  • 942
  • 1004
  • 1275
  • 1395

Prompt Preview

Apply these rules to services and clients using google.golang.org/grpc, including generated RPC handlers, streaming calls, authorization interceptors, and optional xDS integrations.

Transport identity and destinations

  • Configure clients with grpc.WithTransportCredentials(credentials.NewTLS(...)) and native servers with grpc.Creds(credentials.NewTLS(...)). Use tls.RequireAndVerifyClientCert and the intended client CA pool when client certificates establish identity. Keep HTTP/2 ALPN negotiation enabled. Reserve insecure.NewCredentials() and plaintext listeners for an explicitly protected local transport; never fall back to them after a TLS error.
  • Call peer.FromContext(ctx), check that a peer was returned, and take transport identity from its AuthInfo and verified TLS certificate chain or ALTS identity. A source address, :authority, or caller-supplied identity header is not an authenticated principal. With ALTS, set ClientOptions.TargetServiceAccounts to the expected service accounts and authorize AuthInfo.PeerServiceAccount() on the server; keep its handshaker address under deployment control.
  • Keep grpc.NewClient targets, resolver schemes, ports, WithAuthority, and CallAuthority overrides in trusted configuration or an explicit destination allowlist. WithAuthority changes the channel's TLS authentication name as well as its authority header; per-call overrides require an AuthorityValidator. Certificate acceptance alone does not authorize sending a credential to a different service.
  • Apply SSRF destination checks to every connection