net/http as the framework: Handler, the 1.22 ServeMux, and routing without dependencies

One interface, one method

Before you reach for a router library, understand what the stdlib already gives you — the answer changes every dependency decision you make afterward.

Everything in Go’s HTTP stack — routers, middleware, frameworks, your code — speaks one contract:

type Handler interface {
	ServeHTTP(w http.ResponseWriter, r *http.Request)
}

// HandlerFunc adapts a plain function to the interface —
// it's a named function type with a ServeHTTP method that calls itself.
type HandlerFunc func(http.ResponseWriter, *http.Request)

func (f HandlerFunc) ServeHTTP(w http.ResponseWriter, r *http.Request) { f(w, r) }

HandlerFunc is the trick worth pausing on: it is a function type that implements the interface, so any function with the right signature converts into a Handler with zero allocation — mux.Handle("/x", http.HandlerFunc(myFunc)), or the shorthand mux.HandleFunc("/x", myFunc). And ServeMux itself implements Handler, which means routers nest: a mux can be a handler inside another mux, a middleware wraps a mux the same way it wraps a single endpoint. This uniformity is why Go’s ecosystem composes so cleanly — there is no framework-specific handler signature to bridge, just one method. The server side mirrors it: http.Server takes any Handler as its root; http.ListenAndServe(addr, mux) spawns one goroutine per connection, so your handler code is concurrent by default and must be safe for it — a plain map shared across handlers without a mutex is a data race on the second simultaneous request.

The 1.22 ServeMux: methods, wildcards, precedence

Until Go 1.22 the stdlib mux matched only literal prefixes — no methods, no path params — and that gap is what third-party routers filled for a decade. The 1.22 patterns close it:

mux := http.NewServeMux()
mux.HandleFunc("GET /users/{id}", getUser)        // {id} matches one segment
mux.HandleFunc("POST /users", createUser)          // method-specific
mux.HandleFunc("GET /files/{path...}", serveFile)  // {path...} matches the rest
mux.HandleFunc("GET /{$}", home)                   // {$} = exactly "/", no subtree

func getUser(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id") // wildcard value, no context dance
	// ...
}

The rules that matter in production:

• Method patterns: a pattern with a method only matches that method — except GET, which also matches HEAD (the server discards the body). A method-less pattern matches all methods. A request that matches a path but no method gets 405 Method Not Allowed automatically.
• Precedence is most-specific-wins, not first-registered-wins: GET /users/new beats GET /users/{id}, and /users/{id} beats /users/. Registration order is irrelevant — a deliberate design choice so a route’s behavior never silently depends on init order.
• Conflicts panic at registration: if two patterns overlap and neither is more specific (GET /a/{x}/c vs GET /a/b/{y} — both match /a/b/c), Handle panics at startup. Loud and early beats quiet and wrong.
• A trailing-slash pattern like /static/ matches the whole subtree and triggers a 301 redirect from /static to /static/.

When you actually need a framework

When you find yourself reaching for a router library, ask what you actually need that the stdlib mux does not provide — the list is shorter than you expect.

Be honest about what third-party web frameworks add on top of this: parameter binding and validation, content negotiation helpers, middleware ecosystems, route groups. None of that is routing — the 1.22 mux matches per-request in well under a microsecond, which disappears next to a single 200 µs database round trip. The costs of a framework are real and recurring: a non-standard handler signature that every middleware must adapt to, a dependency tree you audit forever, and an abstraction between you and ResponseWriter exactly when you need Flusher or Hijacker. The pragmatic line most Go teams draw: start with net/http plus a thin middleware chain; reach for a router library only when you need something the mux genuinely lacks (regex constraints, per-route middleware DSLs). What you should not do is hand-roll validation badly and call it framework-free — pull a focused library for the focused job instead of a framework for everything.