Guard the endpoint¶

A /metrics endpoint exposes internal counters; a pprof endpoint exposes heap and goroutine dumps. Neither may ever be an unauthenticated open port. There are two safe postures — pick one.

Option 1 — auth middleware¶

Pass your service's auth guard via WithMiddleware. It wraps the metrics endpoint (and pprof, if enabled). The parameter is the standard Go middleware signature, so go/transport's AuthMiddleware (or any func(http.Handler) http.Handler) works directly:

import transporthttp "gitlab.com/phpboyscout/go/transport/http"

metrics.Register(mux,
    metrics.WithMiddleware(transporthttp.AuthMiddleware(/* … */)),
)

Multiple middlewares apply in order — the first is the outermost (first to see the request):

metrics.WithMiddleware(recover, authenticate, ratelimit)

Option 2 — bind to loopback¶

For a single-user local tool, binding the server to 127.0.0.1 (or an internal address unreachable from outside) is a sufficient guard on its own:

_ = http.ListenAndServe("127.0.0.1:8080", mux)

or, with a standalone metrics server, give it a loopback port so it is never externally reachable.

The warning¶

If you call MountOn / Register with no WithMiddleware, the module logs a warning:

metrics endpoint mounted without guard middleware; ensure it is bound to loopback or fronted by auth

That is expected and correct for the loopback posture — it is a reminder, not an error. Supply WithLogger to route it through your logger. If you did intend middleware, the warning tells you it did not reach Register.