I wrote a Go Web Application with authentication and an API to learn Golang.

I must say, writing an API and some other services (SMTP pipe listener) was much nicer in Go than Authentication.

There is gorilla/sessions for sessions, but there's a lot to be desired here. A weak secret here means other people can decrypt the SessionStore Blob and possibly get secret information as a passive attacker or authenticate as another user. This sessionstore passphrase is the key to your entire webapp.

There's also nothing built in to Go for CSRF tokens, and HTMLTemplates are nice for preventing XSS but a pain in the butt for embedding, generating, and storing/regenerating (depending on how big you are) CSRF tokens.

Overall though....Writing Go has been pure joy for me. These are super knitpicky things to complain about.