I couldn’t imagine writing a huge web app in Go without a framework, but you can go framework-free if you’re doing microservices or APIs. I recently used Echo to build my latest side project https://kvdb.io - Echo and similar frameworks provide small enough API on top of net/http that you’re reducing boilerplate without framework lock-in. Most provide basic middleware like anti-CSRF, Basic auth, etc. but for app-wide security and access control like roles, you might want to use a specific library.

Compared to Rails and Django, Go web dev seems closer to the metal with less magic going on, and that’s probably a good thing.