mux in a global state

[j]

Just rising a concern real quick (I'm sorta new to Go, so bear with me ;)).

I noticed that the mux in default.go is global. My concern is if one of my dependencies uses mux, can they expose routes to my app? How potentially "unsafe" is it since the goji mux is global?

Is it safer just to usegithub.com/zenazn/goji/web directly?

PS. great work.

[zenazn]

Yeah, they'd be able to expose routes to your app. But people would already be able to do this using net/http, which the top-level goji package also goes through.

Many people actually want this behavior explicitly. For instance, it means that the net/http /debug/ endpoints work as expected. It's your responsibility to block these in nginx (or similar) if you don't want to expose them to the world.

It's not "unsafe" in the thread safety sense, in the off chance that's what you mean. I'm pretty sure Goji is entirely thread-safe.

But if you want to completely control your mux and all its routes, I'd definitely instantiate it yourself.