https://blog.gopheracademy.com/advent-2016/exposing-go-on-th... covers a number of issues that should be considered.

By default there are no timeouts in net/http, for example. And you cannot specify them for everything. This has been going on for a long time, they fix one timeout here and there from version to version, as people report leaks, but to this day can't seem to cover all the bases.