Just doing a search&replace in the whole URI string isn't safe. What if there is a "localhost" somewhere in the non-host part? This would be better done by parsing the URI (see e.g. http://golang.org/pkg/net/url/#URL) and replacing the host part of the URL only if it exactly matches one of the localhost string variants.