net/http/pprof Endpoints

## What the import actually is Go requires every import to be used. When you want a package purely for the work its `init` function does, you import it under the blank identifier: ```go import _ "net/http/pprof" ``` That is called a blank, or side-effect, import. No symbol from the package becomes available to your code; the only thing you get is whatever the package does at initialisation time. ## What net/http/pprof does at init The package's `init` registers HTTP handlers by calling the package-level `http.HandleFunc`, which writes into `http.DefaultServeMux` — the request router that the `net/http` package keeps as a package-level global. The paths registered directly are: - `/debug/pprof/` — the index handler, `pprof.Index` - `/debug/pprof/cmdline` — the process's command line, `pprof.Cmdline` - `/debug/pprof/profile` — a CPU profile collected over a window, `pprof.Profile` - `/debug/pprof/symbol` — address-to-function-name lookup, `pprof.Symbol` - `/debug/pprof/trace` — an execution trace over a window, `pprof.Trace` The index handler does more than render a page. Any path under `/debug/pprof/<name>` is served by looking `<name>` up among the runtime's named profiles, which is how `/debug/pprof/heap`, `/debug/pprof/allocs`, `/debug/pprof/goroutine`, `/debug/pprof/threadcreate`, `/debug/pprof/block` and `/debug/pprof/mutex` all work without a registration of their own. The same package also exports `pprof.Handler(name)` if you want one of those as an `http.Handler` you place yourself. Notice what is *not* in that list: the import starts no goroutine, opens no socket, binds no port, and collects nothing. Sampling begins when a request arrives, and only for the endpoint requested. Two of those profiles — block and mutex — additionally stay empty until the program has switched their sampling on, which is a separate decision from importing this package. ## Reaching the handlers Because the handlers live on `http.DefaultServeMux`, something must serve that mux. Two things do: 1. `http.ListenAndServe(addr, nil)` — a nil handler means `http.DefaultServeMux`. Same for `http.Server{Addr: addr}` with no `Handler` set. 2. Mounting it explicitly, e.g. `http.ListenAndServe(addr, http.DefaultServeMux)`. The idiom the standard library documents is a tiny listener on loopback, started in its own goroutine so it does not block the program's real work: ```go go func() { log.Println(http.ListenAndServe("localhost:6060", nil)) }() ``` Port 6060 is only a convention; nothing in the package knows about it. Once that listener is up you can point a browser at `http://localhost:6060/debug/pprof/`, or fetch a profile with the toolchain: `go tool pprof http://localhost:6060/debug/pprof/profile?seconds=30`. ## The two failure modes, and they are opposites **Registered but unreachable.** Most non-trivial services build their own router with `http.NewServeMux()` and pass it to the server. In that program the blank import still registers everything — on a mux nobody serves. Engineers then report that "pprof does not work"; the fix is either to serve `http.DefaultServeMux` on a second listener, or to register `pprof.Index`, `pprof.Cmdline`, `pprof.Profile`, `pprof.Symbol` and `pprof.Trace` onto a mux of your own. **Registered and far too reachable.** The mirror image is the reason this import is treated as a security-relevant line. If the public listener was started with a nil handler, `/debug/pprof/` is now on the internet: anyone can read the process's command line and arguments, enumerate goroutine stacks, download a heap profile that reveals your code's structure, and force the process to spend thirty seconds of CPU collecting a profile on demand. Worse, the import does not have to be yours — any package anywhere in the dependency graph that blank-imports `net/http/pprof` has the same effect on your process, because the mux it writes to is a global. ## What an interviewer is checking That you know the mechanism rather than the recipe: side-effect import → `init` → `http.HandleFunc` → `http.DefaultServeMux` → whatever serves that mux. Everything else about pprof endpoints — why they are unreachable, why they are exposed, which listener they belong on — follows from that one chain.