Why this matters
Strong TLS and session protections align with SOC 2 encryption controls.
Configure http.Server with tls.Config{MinVersion: tls.VersionTLS12} and set cookies with Secure, HttpOnly, SameSite.
Strong TLS and session protections align with SOC 2 encryption controls.
Side-by-side examples engineers can pattern-match during review.
srv := &http.Server{Addr:":443"} // default TLSsrv := &http.Server{TLSConfig: &tls.Config{MinVersion: tls.VersionTLS12}};
http.SetCookie(w, &http.Cookie{Name:"sid", Secure:true, HttpOnly:true, SameSite:http.SameSiteLaxMode})cfg := &tls.Config{MinVersion: tls.VersionTLS12}cfg := &tls.Config{MinVersion: 0}From the same buckets as this rule.
Public services must require TLSv1.2 or higher and set HSTS (max-age ≥ 15552000, includeSubDomains). Reject plaintext HTTP and weak ciphers; cookies must be Secure and HttpOnly with SameSite set.