Skip to content

net/http: document response body close error handling #58406

@AlexanderYastrebov

Description

@AlexanderYastrebov

Documentation of the net/http package suggests in two examples https://pkg.go.dev/net/http#pkg-overview and https://pkg.go.dev/net/http#example-Get to use defer to close response body and thus ignore returned error:

resp, err := http.Get("http://example.com/")
if err != nil {
	// handle error
}
defer resp.Body.Close()
body, err := io.ReadAll(resp.Body)
// ...

securego linter was recently changed to catch all unhandled errors of io.ReadCloser.Close and therefore it started to catch the very common defer resp.Body.Close() pattern, see discussion securego/gosec#925.

It would be great to update package documentation examples with a proper error handling of resp.Body.Close() (or confirm that defer resp.Body.Close() is a safe and recommended pattern).

Metadata

Metadata

Assignees

No one assigned

    Labels

    DocumentationIssues describing a change to documentation.NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions