[majewsky]

I have written several HTTP-based services in Go. When you only expose an API, net/http is 99% of what you need. There are some useful addons like https://github.com/gorilla, and you'll probably pull in a library for auth.

For services with a web GUI, net/http is not comparable to the likes of Rails or Django. There is a templating library, but it's pretty barebones and you'll have to put quite a lot of boilerplate (or additional libraries) on top to make it work for anything beyond hello-world scale. Also you need libraries for all those secondary concerns that are usually handled on the framework level, like CSRF protection.

[ptman]

you might not need more advanced csrf protection than a cookie samesite policy.

[zadokshi]

Then throw a hidden input field with a CSRF token in your form and your done.

Not sure what the big deal is here.