How does fxamacker/cbor compare to ugorji/go for CBOR in Go?

fxamacker/cbor focuses on security with configurable limits and fast rejection of malformed data, while ugorji/go may offer raw speed but is less hardened against adversarial inputs. fxamacker/cbor also has a more familiar API similar to encoding/json.

How to use struct tags in fxamacker/cbor to reduce encoded size?

Add tags like `cbor:",toarray"` or `cbor:",keyasint"` to struct fields. For example, `toarray` encodes structs as CBOR arrays without field names, reducing size significantly—a nested struct can encode to 1 byte versus 18 bytes for JSON.

Is fxamacker/cbor secure for decoding untrusted data?

Yes, it includes security features like configurable limits for max array elements and nested levels, and fast rejection of malformed CBOR. It passed multiple security assessments, including a nonconfidential one by NCC Group for Microsoft.

Can fxamacker/cbor handle CBOR sequences?

Yes, it supports CBOR Sequences (RFC 8742) with functions like UnmarshalFirst and DiagnoseFirst, which decode sequences item by item and return remaining bytes.

What are the performance benchmarks for fxamacker/cbor?

Benchmarks in the README show it rejects malicious CBOR data in about 47 nanoseconds per operation, much faster than other libraries. Encoding and decoding are optimized for speed without using Go's unsafe package.

How to set up custom encoding modes in fxamacker/cbor?

Create EncOptions from presets like CoreDetEncOptions(), adjust settings if needed, then use EncMode() to get an immutable mode. For example: opts := cbor.CoreDetEncOptions(); em, err := opts.EncMode(). This mode is safe for concurrent reuse.

Does fxamacker/cbor support WebAuthn or CTAP2 Canonical CBOR?

Yes, it includes a CTAP2EncOptions preset for CTAP2 Canonical CBOR, which is required for WebAuthn implementations, ensuring compliance with FIDO2 standards.

cbor — Secure CBOR Codec for Go

What is cbor?

fxamacker/cbor is a comprehensive CBOR (Concise Binary Object Representation) encoding and decoding library for Go. It provides a robust, high-performance alternative to JSON and other binary formats, designed with a strong emphasis on security, speed, and standards compliance. The library is trusted by major organizations and used in critical systems.

Target Audience

Go developers working on systems that require secure, efficient binary data interchange, such as IoT, blockchain, authentication protocols (e.g., WebAuthn), and distributed systems. It is also suitable for projects needing standards-compliant CBOR handling with configurable security limits.

Value Proposition

Developers choose fxamacker/cbor for its security-first design with configurable decoding limits and fast rejection of malformed data, high performance without using Go's unsafe package, and comprehensive standards compliance including CBOR, CBOR Sequences, and Extended Diagnostic Notation. Its API is familiar to users of encoding/json, and it offers struct tag optimizations to automatically reduce encoded size.

CBOR codec (RFC 8949, RFC 8742) with CBOR tags, Go struct tag options (toarray, keyasint, omitempty, omitzero), float64/32/16, big.Int, and fuzz tested.

Use Cases

Best For

Building secure systems that need to defend against adversarial inputs, as it provides configurable decoding limits and fast rejection of malformed CBOR data.
Implementing CBOR-based protocols like WebAuthn (CTAP2) or COSE, which require specific encodings such as CTAP2 Canonical CBOR available as presets.
Reducing network payload sizes in Go applications, thanks to struct tag options like toarray, keyasint, omitempty, and omitzero that automatically shrink encoded data.
High-performance concurrent applications, because its encoding and decoding modes are immutable and safe for reuse across goroutines.
Systems requiring interoperability with CBOR Sequences (RFC 8742) or Extended Diagnostic Notation, as the library fully supports these standards.
Projects that need extensible CBOR tag handling, as it supports built-in and user-defined tags via customizable TagSets and Marshaler/Unmarshaler interfaces.

Not Ideal For

TinyGo projects requiring production-ready CBOR support, as compatibility is experimental and not fully fuzzed.
Teams that prioritize human-readable data formats for debugging and have no binary size or performance constraints.
Applications deeply integrated with Go's encoding/gob or other serialization libraries where switching costs outweigh benefits.
Prototypes or simple tools where the overhead of configuring CBOR settings and struct tags isn't justified.

Pros & Cons

Pros

Security-First Design

Configurable decoding limits and fast rejection of malformed data defend against adversarial inputs, with benchmarks showing it rejects malicious CBOR in 47 ns/op compared to millions for other libraries.

High Performance Without Unsafe

Optimized for speed and memory efficiency without relying on Go's unsafe package, making it safe for concurrent use in production systems.

Standards Compliance

Full support for CBOR RFC 8949, CBOR Sequences RFC 8742, and Extended Diagnostic Notation, ensuring interoperability with other CBOR implementations.

Struct Tag Optimizations

Tags like toarray, keyasint, omitempty, and omitzero automatically reduce encoded size, as shown where a nested struct encodes to 1 byte versus 18 bytes for JSON.

Familiar API

API mirrors encoding/json with functions like Marshal and Unmarshal, reducing the learning curve for Go developers.

Cons

Configuration Complexity

Advanced features require understanding DecOptions and EncOptions, and setting up custom modes or tag sets can be non-trivial, especially for users new to CBOR.

CBOR-Specific Knowledge Needed

Effective use demands familiarity with CBOR standards, tags, and struct tags, which may be a barrier compared to ubiquitous formats like JSON.

Experimental TinyGo Support

TinyGo compatibility is in a beta branch, not fully fuzzed, and has reduced default limits, making it risky for critical TinyGo applications.

Limited Ecosystem

As a CBOR library, it has a smaller community and tooling than JSON, which can affect finding resources or third-party integrations for niche use cases.

Frequently Asked Questions

What is cbor?

Target Audience

Value Proposition

Use Cases

Best For

Building secure systems that need to defend against adversarial inputs, as it provides configurable decoding limits and fast rejection of malformed CBOR data.
Implementing CBOR-based protocols like WebAuthn (CTAP2) or COSE, which require specific encodings such as CTAP2 Canonical CBOR available as presets.
Reducing network payload sizes in Go applications, thanks to struct tag options like toarray, keyasint, omitempty, and omitzero that automatically shrink encoded data.
High-performance concurrent applications, because its encoding and decoding modes are immutable and safe for reuse across goroutines.
Systems requiring interoperability with CBOR Sequences (RFC 8742) or Extended Diagnostic Notation, as the library fully supports these standards.
Projects that need extensible CBOR tag handling, as it supports built-in and user-defined tags via customizable TagSets and Marshaler/Unmarshaler interfaces.

Not Ideal For

TinyGo projects requiring production-ready CBOR support, as compatibility is experimental and not fully fuzzed.
Teams that prioritize human-readable data formats for debugging and have no binary size or performance constraints.
Applications deeply integrated with Go's encoding/gob or other serialization libraries where switching costs outweigh benefits.
Prototypes or simple tools where the overhead of configuring CBOR settings and struct tags isn't justified.

Pros & Cons

Pros

Security-First Design

High Performance Without Unsafe

Optimized for speed and memory efficiency without relying on Go's unsafe package, making it safe for concurrent use in production systems.

Standards Compliance

Full support for CBOR RFC 8949, CBOR Sequences RFC 8742, and Extended Diagnostic Notation, ensuring interoperability with other CBOR implementations.

Struct Tag Optimizations

Tags like toarray, keyasint, omitempty, and omitzero automatically reduce encoded size, as shown where a nested struct encodes to 1 byte versus 18 bytes for JSON.

Familiar API

API mirrors encoding/json with functions like Marshal and Unmarshal, reducing the learning curve for Go developers.

Cons

Configuration Complexity

Advanced features require understanding DecOptions and EncOptions, and setting up custom modes or tag sets can be non-trivial, especially for users new to CBOR.

CBOR-Specific Knowledge Needed

Effective use demands familiarity with CBOR standards, tags, and struct tags, which may be a barrier compared to ubiquitous formats like JSON.

Experimental TinyGo Support

TinyGo compatibility is in a beta branch, not fully fuzzed, and has reduced default limits, making it risky for critical TinyGo applications.

Limited Ecosystem

As a CBOR library, it has a smaller community and tooling than JSON, which can affect finding resources or third-party integrations for niche use cases.

Frequently Asked Questions

cbor

What is cbor?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?

cbor

What is cbor?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?