Backend on Go Fiber with JWT authorization — a typical stack when a Node.js service hits limits, and migration to Go seems complex. Fiber provides a bridge: a familiar Express API but with fasthttp performance. We have been using Fiber for high-load projects for 5+ years and are ready to share experience from 20+ live projects.
One case — an e-commerce store with peak load of 10,000 RPS. Switching from Express to Fiber reduced response time by 40% and memory consumption by 30%. The Node.js development team mastered Fiber within a week thanks to the familiar syntax. Cloud cost savings amounted to approximately $300–500 per month due to lower memory usage, and the full migration paid off in 3 months with a budget of $12,000.
Why Fiber is faster than net/http
Fiber is a Go framework inspired by Express.js. If a developer comes from Node.js, the API will feel familiar. Under the hood, it uses fasthttp instead of the standard net/http, providing ~2x improvement in synthetic HTTP benchmarks. In real-world projects with PostgreSQL and Redis, the difference is smaller, but Fiber remains one of the fastest Go frameworks. According to official Fiber benchmarks, it handles ~400,000 requests/sec vs ~200,000 for Gin. We have implemented it in 10+ commercial projects and observed memory consumption reduction of up to 30%.
An important nuance: fasthttp is incompatible with net/http middleware. This means some of the Go ecosystem (e.g., standard OpenTelemetry middleware for net/http) does not work directly — adapters or Fiber-specific packages are needed.
Implementing JWT Authorization in Fiber
Step 1: Application Initialization
package main
import (
"log"
"os"
"github.com/gofiber/fiber/v2"
"github.com/gofiber/fiber/v2/middleware/compress"
"github.com/gofiber/fiber/v2/middleware/cors"
"github.com/gofiber/fiber/v2/middleware/helmet"
"github.com/gofiber/fiber/v2/middleware/logger"
"github.com/gofiber/fiber/v2/middleware/recover"
"github.com/gofiber/fiber/v2/middleware/limiter"
)
func main() {
app := fiber.New(fiber.Config{
AppName: "MyAPI v1.0",
ReadTimeout: 10 * time.Second,
WriteTimeout: 10 * time.Second,
IdleTimeout: 120 * time.Second,
BodyLimit: 4 * 1024 * 1024, // 4MB
ErrorHandler: customErrorHandler,
DisableStartupMessage: true,
})
app.Use(recover.New())
app.Use(helmet.New())
app.Use(compress.New(compress.Config{Level: compress.LevelBestSpeed}))
app.Use(cors.New(cors.Config{
AllowOrigins: os.Getenv("ALLOWED_ORIGINS"),
AllowCredentials: true,
AllowHeaders: "Origin, Content-Type, Authorization",
}))
app.Use(logger.New(logger.Config{
Format: "${time} | ${status} | ${latency} | ${method} ${path}\n",
}))
app.Use(limiter.New(limiter.Config{Max: 100, Expiration: 60 * time.Second}))
setupRoutes(app)
log.Fatal(app.Listen(":8080"))
}
Step 2: Routing and Grouping
func setupRoutes(app *fiber.App) {
api := app.Group("/api/v1")
// Public
api.Post("/auth/login", authHandler.Login)
api.Post("/auth/refresh", authHandler.Refresh)
// With JWT middleware
api.Get("/products", productHandler.List)
api.Get("/products/:id", productHandler.Get)
protected := api.Group("/", jwtMiddleware)
protected.Get("/profile", authHandler.Profile)
admin := api.Group("/admin", jwtMiddleware, roleMiddleware("admin"))
admin.Post("/products", productHandler.Create)
admin.Put("/products/:id", productHandler.Update)
admin.Delete("/products/:id", productHandler.Delete)
}
Step 3: Handlers
We keep handlers thin: BodyParser into an input struct with validate tags, validator.Struct for validation, service call, mapping domain errors to HTTP statuses. Pagination — via c.QueryInt("page", 1) and c.QueryInt("limit", 20) with an upper limit of 100 records per page. Response is formed using fiber.Map with keys data and pagination so the frontend receives a uniform format. Validation errors return with status 422 and an errors field — an array of 3–5 fields per request. Each handler is about 30–40 lines of code, which is convenient for code review and typical testing.
Step 4: JWT Middleware
package middleware
import (
"strings"
"github.com/gofiber/fiber/v2"
"github.com/golang-jwt/jwt/v5"
)
func JWTMiddleware(secret string) fiber.Handler {
return func(c *fiber.Ctx) error {
auth := c.Get("Authorization")
if !strings.HasPrefix(auth, "Bearer ") {
return fiber.ErrUnauthorized
}
token, err := jwt.Parse(auth[7:], func(t *jwt.Token) (interface{}, error) {
if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
return nil, fiber.ErrUnauthorized
}
return []byte(secret), nil
})
if err != nil || !token.Valid {
return fiber.ErrUnauthorized
}
claims := token.Claims.(jwt.MapClaims)
c.Locals("userID", int(claims["sub"].(float64)))
c.Locals("role", claims["role"])
return c.Next()
}
}
What are the limitations of fasthttp?
fasthttp reuses request/context objects to reduce GC pressure. This requires caution: you must not capture *fiber.Ctx in goroutines without c.Copy(). When passing context to async operations:
func (h *Handler) AsyncProcess(c *fiber.Ctx) error {
// Do not do this — ctx will be reused before goroutine completes
// go func() { h.svc.Process(c) }()
// Make a copy
cc := c.Copy()
go func() {
h.svc.ProcessAsync(context.Background(), cc.Body())
}()
return c.SendStatus(fiber.StatusAccepted)
}
Production configuration for HTTPS
For production, we recommend using TLS via a reverse proxy (Nginx) or built-in listener:
app.ListenTLS(":443", "/path/to/cert.pem", "/path/to/key.pem")
What's included in development
We document the work order in a SoW with a checklist of deliverables:
- Architecture design: database schema in dbdiagram, OpenAPI 3.1 specification, service diagram.
- Fiber application setup: middleware stack (CORS, logger, recover, limiter), timeout configuration.
- Domain implementation: handlers, services, repositories with pgx and transactions.
- Authorization: JWT access + refresh, role model, blacklist via Redis.
- Testing and deployment: unit + integration (100+ cases), Dockerfile, CI/CD in GitHub Actions.
| Stage | Result |
|---|---|
| Architecture | Database schema, API documentation (OpenAPI) |
| Middleware | CORS, logging, rate limits, security |
| Business logic | Handlers, services, repositories |
| Authorization | JWT with roles, refresh tokens |
| File upload | Validation, storage (S3/local) |
| Testing | Unit + integration tests (100+ cases) |
| Deployment | Dockerfile, CI/CD, monitoring |
Development timelines
| Work | Time |
|---|---|
| Setup + middleware + routes | 3–5 days |
| Handlers + service layer | 1–2 weeks |
| Repository + pgx | 3–5 days |
| Auth + cache | 3–5 days |
| Tests | 1 week |
API for a website: 4–8 weeks. Fiber is well-suited for teams with Node.js background transitioning to Go, and for projects with extreme RPS requirements. We have 5+ years of experience with Go and guarantee code quality.
Get a consultation and estimate in 1 day. Contact us to discuss your project.
Additionally, we cover the observability layer: connect OpenTelemetry via Fiber adapters, send traces to Jaeger or Grafana Tempo, export metrics to Prometheus via /metrics. For high-load APIs, we add a pgxpool connection pool with 25–50 connections and pgbouncer in transaction mode before PostgreSQL — this handles peaks up to 15,000 RPS without p95 degradation. We structure logs using zerolog in JSON so Loki and ClickHouse can index them by 8–10 fields. We also include graceful shutdown with a 30-second drain to prevent Kubernetes rollout from breaking open connections. All these details are documented in a 15–20 page runbook that remains with the client's team and is updated during the 3-month warranty support period.