Verification (10 August 2026): Self-contained runnable examples were compile-tested with Go 1.26.5 on Windows/amd64. Multi-file or contextual snippets and intentional compiler-error demonstrations were checked separately in the repository verification matrix.
Go’s http.Client is safe for concurrent use and should usually be reused. A zero-value client has no overall timeout, so production code should configure one or rely on request deadlines deliberately.
Create and send a request
client := &http.Client{Timeout: 5 * time.Second}
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
if err != nil {
return err
}
req.Header.Set("Accept", "application/json")
res, err := client.Do(req)
if err != nil {
return err
}
defer res.Body.Close()Closing the body permits connection reuse. For small responses, read it fully; for large or untrusted responses, impose a limit.
Check status before decoding
if res.StatusCode < 200 || res.StatusCode >= 300 {
body, _ := io.ReadAll(io.LimitReader(res.Body, 8<<10))
return fmt.Errorf("upstream status %d: %s", res.StatusCode, body)
}Do not decode an error response into the success type. Limit captured error bodies so an upstream cannot force large allocations or logs.
Send JSON
payload, err := json.Marshal(input)
if err != nil { return err }
req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(payload))
req.Header.Set("Content-Type", "application/json")Configure transport carefully
The default transport already pools connections. Clone it before customization rather than constructing an incomplete transport from scratch. Configure dial, TLS, response-header, and idle-connection timeouts based on the service’s latency budget.
Retries are safe only when the operation is idempotent or uses an idempotency key. Retry a narrow set of transient failures with backoff and a total deadline; never create an infinite retry loop.