github.com/gorilla/mux

Gorilla/mux has been my go-to HTTP router for years when I need more than net/http's basic patterns. The path variable extraction with `mux.Vars(r)` is clean, and the route matching (schemes, headers, query params) gives fine-grained control without middleware bloat. It integrates seamlessly with standard http.Handler, making it easy to layer in authentication middleware.

From a security perspective, mux is largely neutral—it doesn't introduce vulnerabilities but also doesn't provide secure-by-default guardrails. You must manually validate all path variables extracted via `mux.Vars()` since it returns strings directly with no sanitization. The library has good CVE response history with timely patches when issues arise. Error handling is straightforward but generic; failed route matches fall through to your NotFoundHandler without exposing internal routing logic.

One practical concern: the project is in maintenance mode (archived on GitHub). While stable and battle-tested, this means no new security features. The code is mature with minimal attack surface, but you're on your own for modern features like built-in rate limiting or automatic request validation.

gorilla/mux feels like a natural extension of net/http rather than a replacement. The API is immediately familiar if you've used Go's standard library - you're still dealing with http.Handler and http.HandlerFunc, just with more powerful routing. I was productive within minutes, defining routes with path variables like `/users/{id}` and adding middleware without consulting docs repeatedly.

The error messages are straightforward when you mess up route definitions, and debugging is painless since it integrates cleanly with standard logging and debugging tools. Route matching logic is transparent - no magic middleware chains that hide behavior. When routes don't match as expected, adding a NotFoundHandler makes it trivial to see what's happening.

Community support is excellent. Most common questions have well-documented answers on Stack Overflow, and the GitHub issues show maintainers who respond thoughtfully. The examples in the README cover 90% of real-world use cases: middleware, subrouters, CORS, method matching, and query parameters. It's stable enough that I've never had an update break existing code.

gorilla/mux is a straightforward HTTP router that extends Go's standard library cleanly. The API for defining routes with path variables and query parameters is intuitive, and it integrates seamlessly with standard http.Handler patterns. From a security standpoint, it's relatively neutral—it doesn't impose security constraints but also doesn't provide much guidance.

The route matching system is predictable and doesn't have hidden gotchas around path traversal, but you need to manually validate all extracted variables. There's no built-in sanitization or type coercion, which is both a blessing (no magic) and a curse (easy to forget). The library correctly handles URL encoding in path parameters, but you're fully responsible for all input validation logic.

One notable concern: error responses and panics in middleware can expose route patterns if not handled carefully. The library has minimal dependencies which reduces supply chain risk, and it's been stable with infrequent CVEs. However, maintenance has slowed significantly—the last release was over a year ago despite pending issues. For new projects, consider whether stdlib's ServeMux enhancements in Go 1.22+ meet your needs before adding this dependency.