* Remove 32-bit limitation
* Fix build problems
* Add 32-bit disclaimer and fix MSVC x86 warnings
- Move 32-bit warning to top of README with strong disclaimer
- Add static_cast<size_t> to fix truncation warnings on 32-bit MSVC
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Update README for clarity and quick start instructions
- Refine default config.toml with hostname and base path
- Adjust index.md files for consistent heading levels
- Simplify CSS for code block styling and remove unnecessary theme switching
- Refactor SiteConfig to derive full base URL from hostname and base path
- Update MarkdownRenderer to remove light theme handling
- Implemented a search button in the header of each documentation page.
- Added a search modal that allows users to input search queries.
- Integrated a JavaScript search feature that fetches and displays results from a new `pages-data.json` file.
- Each documentation page now includes a search overlay for improved navigation.
- Updated the main JavaScript file to handle search logic, including result highlighting and navigation.
- Created a `pages-data.json` file containing metadata for all documentation pages to facilitate search functionality.
- Added a favicon link to all tour pages in the Japanese documentation.
- Updated navigation links to include SVG icons for Home and GitHub.
- Changed language button to include an SVG icon for better visual representation.
- Improved theme toggle button to use SVG icons for light and dark modes.
- Refactored the documentation build commands in the justfile for clarity and consistency.
* [CMake] New component MbedTLS
New component MbedTLS.
* Fix case
Fix case: HTTPLIB_REQUIRE_OPENSSL=OFF; HTTPLIB_REQUIRE_MBEDTLS=ON
* [CMake] Test target MbedTLS::tfpsacrypto
[CMake] Test target MbedTLS::tfpsacrypto.
* [CMake] Test MbedTLS::mbedx509
[CMake] Test MbedTLS::mbedx509.
* Revert "[CMake] Test MbedTLS::mbedx509"
This reverts commit 1d0b91f59a.
* Revert "[CMake] Test target MbedTLS::tfpsacrypto"
This reverts commit bf099f6264.
* Fix problem caused by the recent performance improvement
* wolfSSL support
wolfSSL support.
Partly solve https://github.com/yhirose/cpp-httplib/issues/2371. Only
meson is missing.
* Solve https://github.com/yhirose/cpp-httplib/issues/2361
Solve https://github.com/yhirose/cpp-httplib/issues/2361.
Apply `WARNING`.
* Fix variable
Fix variable.
* [CMake] Solve incompatibilities with loop
Solve incompatibilities with loop.
* Fix
Fix.
* Remove debug prints
Remove debug prints.
* [CMake] Fix bug
Prevent a bug aus the required and if available libraries are checked
independently from each other. A could be chosen in required but B could
be chosen in if available and everything would pass.
* Remove debug print
Remove debug print.
* Restore change
Restore change.
---------
Co-authored-by: yhirose <yuji.hirose.bug@gmail.com>
* Add initial documentations
* Update documentation for Basic Client and add WebSocket section
* feat: add a static site generator with multi-language support
- Introduced a new Rust-based static site generator in the `docs-gen` directory.
- Implemented core functionality for building sites from markdown files, including:
- Configuration loading from `config.toml`.
- Markdown rendering with frontmatter support.
- Navigation generation based on page structure.
- Static file copying and output directory management.
- Added templates for base layout, pages, and portal.
- Created a CSS file for styling and a JavaScript file for interactive features like language selection and theme toggling.
- Updated documentation source with new configuration and example pages in English and Japanese.
- Added a `justfile` target for building the documentation site.
* Add language/theme toggle functionality
- Created a new Japanese tour index page at docs/ja/tour/index.html
- Implemented navigation links for various sections of the cpp-httplib tutorial
- Added a language selector to switch between English and Japanese
- Introduced theme toggle functionality to switch between light and dark modes
- Added mobile sidebar toggle for better navigation on smaller screens
* WebSocket support
* Validate selected subprotocol in WebSocket handshake
* Fix problem with a Unit test
* Dynamic Thread Pool support
* Fix race condition in new Dynamic ThreadPool
* Remove macOS select() fallback
macOS has supported `poll` for a long time now, so there's no need for
the specific `select` code paths.
With this commit, we can successfully build on visionOS.
Signed-off-by: Adrien Gallouët <adrien@gallouet.fr>
* Fix coding style
Signed-off-by: Adrien Gallouët <adrien@gallouet.fr>
---------
Signed-off-by: Adrien Gallouët <adrien@gallouet.fr>
* Fix compilation on BoringSSL by replacing ASN1_TIME_to_tm
BoringSSL doesn't expose `ASN1_TIME_to_tm`.
This patch switches to using `ASN1_TIME_diff` to calculate `time_t`.
This is supported by OpenSSL, LibreSSL, and BoringSSL, and also avoids
the platform-specific `timegm` vs `_mkgmtime` logic.
Signed-off-by: Adrien Gallouët <adrien@gallouet.fr>
* Format code
Signed-off-by: Adrien Gallouët <adrien@gallouet.fr>
* Use detail::scope_exit
Signed-off-by: Adrien Gallouët <adrien@gallouet.fr>
---------
Signed-off-by: Adrien Gallouët <adrien@gallouet.fr>
* Correct sign comparison error with sk_X509_OBJECT_num
In some build configurations, sk_X509_OBJECT_num (from BoringSSL) returns a size_t. Comparing this directly against a signed int loop counter triggers -Werror,-Wsign-compare.
Instead, move the count into a local int variable so the compiler uses implicit conversion to ensure type consistency during the loop comparison.
* Update httplib.h
* Update httplib.h
Missed a s/int/decltype(count)
* Fix#2339
* Fix CI errors
* Fix Windows build error
* Fix CI errors on Windows
* Fix payload_max_length initialization in BodyReader
* Initialize payload_max_length with CPPHTTPLIB_PAYLOAD_MAX_LENGTH in BodyReader
* Update README and tests to clarify payload_max_length behavior and add no limit case
* Fix server thread lambda capture in ClientVulnerabilityTest
* Add C++ modules support
* Add module examples
* Missing semicolon
* Update GitHub Actions script and create a modules updating script
* Name the unused param
* Use the guarded/direct export of header approach
* Update CMakeLists.txt
Co-authored-by: Andrea Pappacoda <andrea@pappacoda.it>
* Update CMakeLists.txt
Co-authored-by: Andrea Pappacoda <andrea@pappacoda.it>
* Split scripts into split.py and generate_module.py
---------
Co-authored-by: Andrea Pappacoda <andrea@pappacoda.it>
* Add Tests for case sensitive hostname verfication
* Modify check_host_name to perform case insensitive comparisons during ssl hostname validation
---------
Co-authored-by: Tabor, Chris <chris.tabor@commscope.com>
Both APIs conceptually do the same thing: "use these CA certs for
verification." However, set_ca_cert_store() falls through to the else
branch in load_certs() where system certs are added to the user's
custom store, defeating the purpose of certificate pinning.
This change makes set_ca_cert_store() behave consistently with
set_ca_cert_path() by checking ca_cert_store_ before loading system
certificates.
Added test to verify system certs are not loaded when custom store is set.
Co-authored-by: Your <you@example.com>
* Resolve#2262
* Enhance request handling on Windows by adding early response check for large request bodies
* Enhance early response handling for large requests with long URIs on Windows
* Fix problem with 'windows without SSL`
* Fix payload limit enforcement for requests without Content-Length on Windows
- Enable MSG_PEEK on Windows (non-SSL builds) to detect payloads without Content-Length
- Only use MSG_PEEK when payload_max_length is set to a finite value to avoid blocking
- Use read_content_without_length for actual size checking to support any payload limit
- Set 413 Payload Too Large status before rejecting oversized requests
This fixes three test cases on Windows:
- RequestWithoutContentLengthOrTransferEncoding (no payload limit)
- NoContentLengthPayloadLimit (8-byte limit)
- NoContentLengthExceeds10MB (10MB limit)
* clang-format
* Ensure payload_max_length_ is respected for compressed payloads
* Fix Denial of service (DOS) using zip bomb
---------
Co-authored-by: Hritik Vijay <hey@hritik.sh>
On Windows cpp-httplib defines ssize_t, therefore applications needing
to define ssize_t for their own needs or are using libraries that do
require a means to avoid a possible incompatible redefinition.
Signed-off-by: Ralph Sennhauser <ralph.sennhauser@gmail.com>
To avoid surprises in the projects consuming the library, don't define
BUILD_SHARED_LIBS option ourselves but just use its value, if provided,
to define HTTPLIB_SHARED option which can be also set directly to
specify whether we should build static or shared library.
Closes#2263.
* Fix HTTP 414 errors hanging until timeout
* All errors (status code 400+) close the connection
* 🧹
---------
Co-authored-by: Wor Ker <worker@factory>
When the `SSLClient` is used to connect to a plain-HTTP server (which
can happen in clients due to some end-user misconfiguration) it can
return a failure from the `send()` call without setting the `Error`
reference to the corresponding error code. This can cause problems to
callers, that may expect that, when the check like this is passed on
the response:
```c++
if (res.error() == Error::Success)
```
then they can access the response contents with `res.value()`. When
`SSLClient`'s connection fails - the contents `unique_ptr` is not set
and an attemt to access it causes UB.
This change fixes the `SSLClient::create_and_connect_socket` method
making sure that, the `Error` value is set correctly when the
`is_valid()` check fails.
* Fix use of dangling references
When the resolve thread is detached, local variables were still used, which could lead to a program crash.
* Add test to verify dangling ref fix
* Add missing brace initialization
* Assert that the remaining fields are really zeroed
* Fix use of chrono literals
* Initialize start time for server
By initializing start_time_ for server, I hope to measure the time taken to process a request at the end maybe in the set_logger callback and print it.
I only see current usage in client with server retaining the inital min value
* Add test to verify start time is initialized
* Address review comments
* run clang format
* osx: fix inconsistent use of the macro `TARGET_OS_OSX`
Fixed the build error on iOS:
```
httplib.h:3583:3: error: unknown type name 'CFStringRef'
870 | CFStringRef hostname_ref = CFStringCreateWithCString(
```
Note, `TARGET_OS_OSX` is defined but is 0 when `TARGET_OS_IOS` is 1,
and vise versa. Hence, `TARGET_OS_MAC` should have been used, that is
set to 1 for the both targets.
* improve: non-blocking getaddrinfo() for all mac target variants
`TARGET_OS_MAC` should have been used, that is set to 1 for all other
targets: OSX, IPHONE (IOS, TV, WATCH, VISION, BRIDGE), SIMULATOR,
DRIVERKIT.
This is a follow-up to commit 4ff7a1c858,
which introduced new simplified build options and deprecated the old
ones. I forgot to also change the various get_option() calls,
effectively rendering the new option names useless, as they would not
get honoured.
On 32-bit Windows, meson setup fails with an unclear error:
meson.build:25:16: ERROR: Could not get define 'CPPHTTPLIB_VERSION'
The actual problem is that httplib.h #errors out.
Have the Meson logic explicitly check for a 32-bit host and warn or error,
matching the check in httplib.h. Phrase the Windows error in a way that
triggers WrapDB CI's unsupported architecture check.
The "cpp-httplib_" prefix of build options is now dropped, as Meson
build options are already namespaced for each project. The old names
remain as deprecated aliases for the new ones.
This new option automatically enables the new non-blocking name
resolution when the appropriate libraries are found, automatically
adding them to the list of required dependencies. It will gracefully
fall back to the old behaviour when no library is found.
This complements commit ea850cbfa7.
* Add proxy test on CI
* Add Brotli and Zstd dev packages to proxy test workflow
* Fix Docker Compose command for GitHub Actions compatibility
* Add proxy readiness check and netcat dependency
* Use netcat-openbsd instead of virtual netcat package
* Add proxy startup delay and debug logging
* Add test for multipart form data with boundary split
Add a test for multipart form data requests with a large header which
leads to a split inside the boundary because of the read buffer size
inside the SocketStream class.
* Fix bad request for multipart form data with boundary split
Fix a bad request (400) response for multipart form data requests with
a large header which leads to a split inside the boundary because of the
read buffer size inside the SocketStream class. The parse function
inside the MultipartFormDataParser wrongly erase the receive buffer if
it doesn't find the boundary inside the buffer during first call.
* Fix#2157
* Fix Windows build error: wrap std::max in parentheses to avoid macro conflict
- On Windows, max/min are often defined as macros by windows.h
- This causes compilation errors with std::max/std::min
- Solution: use (std::max) to prevent macro expansion
- Fixes CI build error: error C2589: '(': illegal token on right side of '::'
Fixes: error in coalesce_ranges function on line 5376
* Adds headers to multipart form data
Adds a `headers` field to the `MultipartFormData` struct.
Populates this field by parsing headers from the multipart form data.
This allows access to specific headers associated with each form data part.
* Adds multipart header access test
Verifies the correct retrieval of headers from multipart form data file parts.
Ensures that custom and content-related headers are accessible and parsed as expected.
* Enables automatic test discovery with GoogleTest
Uses `gtest_discover_tests` to automatically find and run tests, simplifying test maintenance and improving discoverability.
* Removes explicit GoogleTest include
* Refactors header parsing logic
Improves header parsing by using a dedicated parsing function,
resulting in cleaner and more robust code.
This change also adds error handling during header parsing,
returning an error and marking the request as invalid
if parsing fails.
* clang-format corrected
* Renames variable for better readability.
Renames the `customHeader` variable to `custom_header` for improved code readability and consistency.
* typo
* fix(parser): Limit line length in getline
Prevents potential infinite loop and memory exhaustion in
stream_line_reader::getline by enforcing max line length.
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
* fix: increase default max line length to 32k
LONG_QUERY_VALUE test is set at 25k.
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
* test(client): expect read error with too long query
Adds a test case (`TooLongQueryValue`) to verify client behavior
when the request URI is excessively long, exceeding
`CPPHTTPLIB_MAX_LINE_LENGTH`. In this scenario, the server is
expected to reset the connection.
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
---------
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
* Support zstd also via pkg-config
It doesn't always provide cmake config
* Find zstd with pkg-config also in non-required case
Code by @sum01, slightly modified
afunix.h uses types declared in winsock2.h, and so has to be included
after it. Including afunix.h first will result in a somewhat unhelpful
compilation error:
error C3646: 'sun_family': unknown override specifier
Signed-off-by: Piotr Stankiewicz <piotr.stankiewicz@docker.com>
* Add zstd support
* Add zstd to CI tests
* Use use zstd cmake target instead of ZSTD. Use cmake variable for found packages
* Add missing comment for HTTPLIB_REQUIRE_ZSTD
* Fix test.yaml rebase error
* Use zstd::libzstd target
* Add include and library paths to ZSTD args
* Run clang-format
* Add zstd to httplibConfig.cmake.in
By making the random engine thread_local, each thread now has its own
independent random sequence, ensuring safe concurrent access.
Additionally, using an immediately invoked lambda expression to
initialize the engine eliminates the need for separate static seed
variables.
* Wrap poll()/WSAPoll() in a function
Instead of using a macro for poll() on Windows, which breaks when the
implementation is compiled separately, add a detail::poll_wrapper()
function that dispatches to either ::poll() or ::WSAPoll().
* Build compiled library on Windows
Redirect tests fail using httpbin.org or nghttp2.org/httpbin. The
location header value contains a string representation of a Python byte
string (e.g., b'http://www.google.com/'), which results in a 404 error.
* Revert "Fix typo in meson.build (#2070)"
This reverts commit 5c0135fa5d.
* Revert "build(meson): automatically use poll or select as needed (#2067)"
This reverts commit 2b5d1eea8d.
* Revert "Make poll() the default (#2065)"
This reverts commit 6e73a63153.
* Remove select() and use poll()
- Replace is_readable() with wait_readable() and is_writable() with
wait_writable() in the Stream interface.
- Implement a new is_readable() function with semantics that more
closely reflect its name. It returns immediately whether data is
available for reading, without waiting.
- Update call sites of is_writable(), removing redundant checks.
* server_certificate_verifier extended to reuse built-in verifier
* code cleanup and SSLVerifierResponse enum clarification as per @falbrechtskirchinger comment
* cleanup
* clang-format
* change local var verification_status_ declaration to auto
* change local var verification_status_ to verification_status
* clang-format
* clang-format
---------
Co-authored-by: UrosG <uros@ub330.net>
Add include_httplib.cc to the main test executable (already done in
Makefile), and add include_windows_h.cc to the main test executable on
Windows to test if including windows.h conflicts with httplib.h.
* Add workflow_dispatch with Google Test filter
Add the workflow_dispatch trigger to the test.yaml workflow. Includes an
input for an optional Google Test filter pattern.
* Add OS selection to workflow_dispatch
* Fix wording
This CI workflow checks ABI compatibility between the pushed commit and
the latest tagged release, helping preventing accidental ABI breaks.
Helps with https://github.com/yhirose/cpp-httplib/issues/2043
Consider Content-Length and Transfer-Encoding headers when determining
whether to expect content. Don't handle the HTTP/2 connection preface
pseudo-method PRI.
Fixes#2028.
Modify for OpenVMS x86 C++. Make tests on OpenVMS currently not supported due to no cmake support.
Changes tested on OpenVMS clang C++ and Fedora & GCC
RFC-9110 '14.1.2. Byte Ranges':
A client can limit the number of bytes requested without knowing the
size of the selected representation. If the last-pos value is absent,
or if the value is greater than or equal to the current length of the
representation data, the byte range is interpreted as the remainder of
the representation (i.e., the server replaces the value of last-pos
with a value that is one less than the current length of the selected
representation).
https://www.rfc-editor.org/rfc/rfc9110.html#section-14.1.2-6
The testsuite checks for the exact size of the compressed content. The
exact size can change if the zlib library is using a different strategy.
In thise case using zlib-ng results in a slightly larger content leading
to a failure in the test.
Check that the compressed content is less than 10MiB which is a tenth of
the orignal content and proves that compression works.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
* build(meson): bump minimum version to 0.62.0
This allows making some minor cleanups
* test(meson): fix SSLClientServerTest.* tests with OpenSSL 3.2.0
Since OpenSSL commit
<https://github.com/openssl/openssl/commit/342e3652c791bdb06e08abcc169b4456c83ccd00>,
the default X.509 certificate format generated with the `openssl req`
command has been changed to X.509 v3 from X.509 v1.
For some reason, this change breaks cpp-httplib's SSLClientServerTest.*
tests.
To fix the test failures, this patch passes the '-x509v1' flag instead
of '-x509' when OpenSSL 3.2.0 or newer is detected. To detect the
version of a command line utility, Meson 0.62.0 or later is required.
Fixes <https://github.com/yhirose/cpp-httplib/issues/1798>, but only for
the Meson build system.
* Renamed enable_server_host_verification to enable_server_hostname_verification and added Error::SSLServerHostnameVerification
* Add some Open SSL function calls
* Code cleanup
* Fix#1431
This patch is necessary to build cpp-httplib in Crashpad, itself in
Chromium, using BoringSSL. Details at [1].
The fixes include:
- Library version check: tolerate BoringSSL as an alternative to
OpenSSL 3.
- Don’t call `OPENSSL_thread_stop`, which is not in BoringSSL.
- Use `SSL_get_peer_certificate` (deprecated in OpenSSL 3), the old
name for `SSL_get1_peer_certificate`, because the new name is not in
BoringSSL.
- Call `SSL_set_tlsext_host_name` directly instead of making an
`SSL_ctrl` call that BoringSSL does not support. The feared
-Wold-style-cast warning that occurs when buidling with OpenSSL is
not triggered in BoringSSL.
[1] https://chromium.googlesource.com/crashpad/crashpad/+/1a62a0182557c89494676c06611f1ca731bcb2db
The test used the hardcoded long value for 64 bit machines even on 32
bit ones, leading to test failures. With this patch the max long length
is obtained using std::numeric_limits<long>::max(). Thanks to q2a3z for
the hint!
Fixes: https://github.com/yhirose/cpp-httplib/issues/1795
* New function SSLServer::update_certs. Allows to update certificates while server is running
* New function SSLServer::update_certs. Added unit test
* avoid memory leaks if linked with static openssl libs
---------
Co-authored-by: CEU\schielke <Rainer.Schielke@heidelberg.com>
* New function SSLServer::update_certs. Allows to update certificates while server is running
* New function SSLServer::update_certs. Added unit test
---------
Co-authored-by: CEU\schielke <Rainer.Schielke@heidelberg.com>
Release builds result in the following warning because `content_length` param was used only inside asserts:
1> cpp-httplib\httplib.h(4933,45): warning C4100: 'content_length': unreferenced formal parameter
* Windows has WSAAccept() which will create sockets inheriting flags from
the server socket
* Linux has accept4() which has a flags argument supporting SOCK_CLOEXEC
* Implement string divider to replace splitter
* Divide query string in half
* Add a test case for query values containing the '=' character
* Add test cases for string divider
* Fix warnings
* Move httplibConfig.cmake.in to cmake dir
Just makes more sense to put it there I suppose.
* Cmake install README & License
Seems to make sense since you might already do this as a package
manager, or an end user might want them anyways.
The locations are just based on standard Linux locations using
GNUInstallDirs, so it should be sane on other machines too.
using lambda expression as Handler in set_error_handler will cause ambiguous.
Template forwarding can forward HandlerWithResponse to the correct overloading function
* Unimportant cleanup of FindBrotli
Some whitespace, removal of an unused var, and add a comment about
the missing version support
* Fix incorrect var in FindBrotli
Not much to say, it was just the wrong one. Not sure how that happened,
maybe a holdover from when I did an overhaul at some point..
* Tiny useless edit to FindBrotli
Just a little tweak to how I was postfixing those -static strings to the
lib names. Mostly pointless..
* Simplify some FindBrotli code
Nothing much, just reducing redundant stuff & a cleanup of a comment.
* Ignore PkgConf in FindBrotli if looking for static
As per the issue mentioned in this comment, static PkgConf support
is broken upstream. After testing, I found it'll just accept shared
even if you try to find static, so I'm merely disabling that feature
for this FindBrotli module.
That said, you can still get the static libs if you have them installed,
but PkgConf will be ignored even if found in favor of a regular
find_library call. Otherwise you'd end up with shared libs even if you
ask for static (with PkgConf installed).
TLDR: actually fail correctly when static libs aren't found when PkgConf
thought they were.
* Reorder cmake docs a bit
Just wanted to group the more related build options together.
Also removed a pointless reference to the old reasoning for the required
min ver since it's 3.14 now anyways.
* Fix outdated cmake comment
We don't use Git to find the version string anymore.
Just updated to match what it's actually used for now.
* Group options and build-tree vars in Cmake
Doesn't really change anything, I just wanted to clean these up a bit.
* Fix how we set HTTPLIB_IS_USING_XXX vars in Cmake
Prevents us acidentally using libs when the user didn't want them
actually used. This could happen if they set the option to OFF but their
own project itself is using the lib, thus we'd find and use it anyways.
Ref #1602 to see an example of this already happening before.
This is merely apply that kind of fix to all 3 of our deps, instead of
just OpenSSL.
* Minor formatting/comment change to Cmake
Pointless, but these things were bothering me..
For very busy servers, the internal jobs queue where accepted
sockets are enqueued can grow without limit.
This is a problem for two reasons:
- queueing too much work causes the server to respond with huge latency,
resulting in repetead timeouts on the clients; it is definitely
better to reject the connection early, so that the client
receives the backpressure signal as soon as the queue is
becoming too large
- the jobs list can eventually cause an out of memory condition
* Fix: Query parameter including query delimiter ('?') not being parsed properly
* Add details::split function with and without m argument to allow split parameters with/without counter
* Revert changes in SplitTest.ParseQueryString
* Fix readability warnings
Did not fix readbility-qualified-auto, will do a separate pull request
* Revert changes where meaning is lost
* Revert some style changes
The exact circumstances when this false positive is triggered are quite
tricky to reproduce, but it happened reproducibly with g++ 13.1 and 13.2 in
a close-source SW I'm working on. The fix even improves performance by a
very tiny bit: There is no need to copy the std::smatch, having a const
reference is enough.
Just as a side note: -Warray-bounds seems to cause trouble in other
projects, too, so e.g. the Linux kernel has disabled since June 2022.
* ClientImpl: Connection=close header control moved from process_request to send_
* Connection=close header control moved from send_ to handle_request
* SSLClient::connect_with_proxy error handling improved
* to_string definition added for Error::ProxyConnection
* Comment improvement
---------
Co-authored-by: akinelden <akin.elden@gmail.com>
* Fix successful decompress reported as Error::Read
Streams less than 4096 bytes are sometimes reported as failed reads because stream_.avail_in is not reduced to 0. The next iteration of the loop finds `prev_avail_in == strm_.avail_in` and return false. `ret = inflate(...)` returns Z_STREAM_END on the first iteration of the loop indicating that inflate is finished. This fix prevents the second iteration of the loop from failing.
* Fix successful decompress reported as Error::Read
- Add unit tests for raw deflate that illustrates the decompression failure when there are extra trailing bytes
GoogleTest, starting with vesion 1.13.0, requires C++14 to build. This
patch enables C++14 if GoogleTest 1.13.0 or newer is detected when
compiling the tests with Meson, making it possible to use new GTest
versions.
You can find GoogleTest's release notes at
<https://github.com/google/googletest/releases/tag/v1.13.0>.
We already detect OpenSSL in our tree for another project, but don't want to
link httplib against OpenSSL or with SSL support.
Allow us to `set(HTTPLIB_IS_USING_OPENSSL FALSE)`.
Removed multiple old-style (C) casts and replaced them with the
appropriate _cast's. This makes httplib a better citizen inside projects
that are compiled with all warnings enabled.
Unfortunately one warning remains as a result of invoking an
OpenSSL macro (at least on Linux), that would have to be fixed
upstream.
Also fixed a few casts for invocations of setsockopt.
setsockopt takes a const void* for the value pointer, not a char*.
Well, except on Windows ...
Co-authored-by: Andre Eisenbach <git@4ae.us>
This allows disabling the use of C++ exceptions at CMake configure time.
The value is encoded in the generated httplibTargets.cmake file and will
be used by CMake projects that import it.
* Explicitly #include <utility> for use of std::move
* Move not copy Logger arg from Client to ClientImpl
* Move not copy, set_error_handler Handler to lambda
* Remove null statement in non-empty if/else block
I guess it was a relic from a time before the other statement was added.
---------
Co-authored-by: Daniel Boles <daniel.boles@voltalis.com>
* Reuse gtest on the system
Try to use gtest on the system if found. Avoid using recent CMake
features.
* Set CMP0135 only when using FetchContent
* Add /bigobj option for MSVC
* Support also cmake between 3.14 and 3.20
Older versions provided only GTest::Main target, not currently used
gtest_main. Provide backward compatibility also to old cmake versions.
* Remove redundant variable checking
---------
Co-authored-by: Jiwoo Park <jiwoo_90@naver.com>
* Support loading system certs from Keychein on MacOS
* review improvements: add deps to meson.build and improve conditional expressions in cmake
* fix tabs
* fix tabs
* review improvements
* fix after review
* additionally load root certs from the system root keychain
* cmake fix
* fix
* small refactoring
* small refactoring
---------
Co-authored-by: Sergey Kazmin <sergey.kazmin@kaspersky.com>
* Add test/CMakeLists.txt to enable testing with CTest
Add HTTPLIB_TEST option
Downlaod GoogleTest source using FetchContent module
Generate cert files to test httplib with OpenSSL
* Generate cert2.pem with a new certificate request
* Use the latest GoogleTest library
* add support for requests with both MultipartFormDataItems and ContentProviders
* rework implementation
* use const auto & and fix offset calculation
* fix zero items
* snake case variables
* clang-format
* commonize get_multipart_content_provider, add Put() with MultipartFormDataProviderItems
* fix linker multiple definition error
* add test MultipartFormDataTest.DataProviderItems
* Add EINTR and EAGAIN judge for accept
* Add EINTR signal tests
* Cancel win32 and win64 compile on signal unittest
Co-authored-by: yukun.yu <yukun.yu@alibaba-inc.com>
* Move next job in task queue rather than copy
* Notify waiting thread after unlocking mutex
* Add unit test for TaskQueue
* Don't use C++14 feature in test code
* handle socket options for UNIX socket same as others
* set FD_CLOEXEC by default
* invoke `socket_options` callback if set
* Offer Client info even on UNIX socket based Server
HTTP Request header "REMOTE_PORT" contains client process id if possible
when Server works on UNIX socket.
* retrigger checks
* retrigger checks
* add support macOS
Co-authored-by: Changbin Park <changbin.park@ahnlab.com>
* SocketStream need to check connectivity for writability.
When the stream is used for SSE server which works via chunked content
provider it's not possible to check connectivity over writability
because it's wrapped by DataSink. It could make the server stalled, when
the provider wants to only keep connection without send data and certain
amount of clients consumes entire threadpool.
* add unittest for SocketStream::is_writable()
SocketStream::is_writable() should return false if peer is disconnected.
* revise broken unittest ServerTest.ClientStop
DataSink could be unwritable if it's backed by connection based. Because
it could be disconnected by client right after enter centent provider.
Co-authored-by: Changbin Park <changbin.park@ahnlab.com>
Release 0.11 broke backwards compatibility, meaning that different
cpp-httplib versions are compatible with each other only if the major
and minor version numbers are the same.
This patch reflects this in the build systems.
See #1209 for some more context.
* httplib.h
add multipart formdata for PUT in addition to POST as some REST
APIs use that.
Factor the boundary checking code into a helper and use it from
both Post() and Put().
* test/test.cc
add test cases for the above.
* Add support UNIX domain socket
* `set_address_family(AF_UNIX)` is required
* add unittest for UNIX domain socket
* add support UNIX domain socket with abstract address
Abstract address of AF_UNIX begins with null(0x00) which can't be
delivered via .c_str() method.
* add unittest for UNIX domain socket with abstract address
Co-authored-by: Changbin Park <changbin.park@ahnlab.com>
* Add get_socket_fd method to Client and ClientImpl, add according unit test
* Change name get_socket_fd to get_socket
* Change name get_socket to socket
Co-authored-by: ata.yardimci <ata.yardimci@erstream.com>
* ssize_t redefinition on Windows - int/int64 vs long/long long
* Define ssize_t as __int64 for _WIN64, not long long
Co-authored-by: iamttaM <9880090+oculusbytes@users.noreply.github.com>
* resolve problem: http server can't send file large than 2GB.
add unit test for http server send large file.
add /bigobj compile option to msvc x64.
* disable unit test "ServerLargeContentTest" due to out-of-memory on GitHub Actions.
- Enable THREADS_PREFER_PTHREAD_FLAG to use -pthread where supported
- Remove low-level compile features (closes#1272)
- Remove unneeded DESTINATION options where possible
Thanks to abf3a67dd0 the use of python3
isn't required anymore to configure the build, so I moved the
find_program('python3') inside the "if compile" block.
This makes it possible to configure cpp-httplib on systems where python
isn't available with tools like muon: https://sr.ht/~lattis/muon/
* Add large data transfer test
* Replace `SSL_read` and `SSL_write` with `ex` functions
* Reflect review comment
* Fix return value of `SSLSocketStream::read/write`
* Fix return value in the case of `SSL_ERROR_ZERO_RETURN`
* Disable `LargeDataTransfer` test due to OoM in CI
Meson only runs required targets. The key_encrypted_pem and
cert_encrypted_pem targets added in 020b0db090
and 8191fd8e6c weren't added to the list
of targets required by the test target, so the generation of the
encrypted certs was skipped, resulting in the failure of
BindServerTest.BindAndListenSeparatelySSLEncryptedKey.
* meson: fix regression that broke extracting version
In commit 33f67386fe the code that
heuristically parsed the version broke due to the version being moved
around into a more easily accessible define.
While we are at it, pass the exact path of httplib.h to un-break usage
as a meson subproject. This was broken in commit
8ecdb11979 which checked the return code
of trying to get the version; it was always broken, but formerly failed
in silence and resulted in no version number.
* meson: use the compiler builtins to extract the version from the header
As a convenient string define, it is now possible to ask the
preprocessor what the version of cpp-httplib is. This can be used from
meson too, in order to avoid encoding C++ file structure into python
regexes.
A pkg-config file was previously installed only if cpp-httplib was being
built as a compiled library.
Since architecture-independent .pc files
can exist in /usr/share/pkgconfig, it can be useful to install one even
when installing the header-only version (for example, it could be used
by third party projects to easily find out if cpp-httplib is installed
and its version, using something like Meson's `dependency()` or CMake's
`pkg_check_modules()`).
The change makes the Meson build behave a bit more like the CMake one,
as it also always installs a CMake Config file, but here the pkg-config
file gets installed to the correct architecture-independent directory
(`datadir` represents /usr/share on Linux and simiar systems).
Lastly, I made some minor cleanups.
This change is based on RFC7230, § 3.5 'Message Parsing Robustness': "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR."
* Fix#1041
* Fixed problem with is_socket_alive
* Adjust the way to check if the sockt is still alive.
* Revert "Adjust the way to check if the sockt is still alive."
This reverts commit 6c673b21e5.
* Adjust is_socket_alive according to the code review
* Allow to specify server IP address
* Reimplement in set_hostname_addr_map
* Add tests for set_hostname_addr_map
* Fix tests after implement set_hostname_addr_map
* SpecifyServerIPAddressTest.RealHostname typo
This integrates the "main" test suite (test/test.cc) in Meson.
This allows to run the tests in the CI with the Meson-built version of
the library to ensure that nothing breaks unexpectedly.
It also simplifies life of downstream packagers, that do not have to
write a custom build script to split the library and run tests but can
instead just let Meson do that for them.
* Full Meson support
cpp-httplib can be now built with Meson even in compiled library mode.
The library is built with LTO, supports OpenSSL, zlib and Brotli,
and the build system also generates a pkg-config file when needed.
Compared to the CMake file this one is quite small (more than five times
smaller!), and maintaining it won't be an issue :)
* meson: automatic versioning
In order to test the split version (.h + .cc via split.py):
- Added a test_split program in the test directory whose main purpose is
to verify that it works to compile and link the test case code against
the split httplib.h version.
- Moved types needed for test cases to the “header part” of httplib.h.
Also added forward declarations of functions needed by test cases.
- Added an include_httplib.cc file which is linked together with test.cc
to verify that inline keywords have not been forgotten.
The changes to httplib.h just move code around (or add forward
declarations), with one exception: detail::split and
detail::process_client_socket have been converted to non-template
functions (taking an std::function instead of using a type parameter for
the function) and forward-declared instead. This avoids having to move
the templates to the “header part”.
When using the split version of httplib.h the templated implementation
of e.g. Client::set_connection_timeout ends up in httplib.cc and
therefore results in a linker error since the needed template
specialization has not been instantiated. Fix this by moving the
implementation of template methods into the part that ends up in
httplib.h after the split.
Fixes#1008.
The RedirectToDifferentPort.Redirect test assumes that port 8080 and
8081 are available on localhost. They aren’t on my system so the test
fails. Improve this by binding to available ports instead of hardcoded
ones.
- Added shebang and made the script executable.
- Added help text.
- Added -o/--out argument for specifying output directory.
- Added -e/--extension argument for specifying file extension of the
implementation file.
- Made the script find httplib.h next to split.py instead of the current
working directory. This makes it possible to call the script from
another directory.
- Simplified code structure slightly.
- Improved variable naming to follow Python conventions.
* Add header-only Meson support
This allows users to call `dependency('httplib')` and have the include
directory automatically configured
* Rename `httplib` to `cpp-httplib`
* Fix virtual call in ClientImpl::~ClientImpl()
This fixes a warning in clang tidy:
> Call to virtual method 'ClientImpl::shutdown_ssl' during
> destruction bypasses virtual dispatch
ClientImpl::~ClientImpl() calls lock_socket_and_shutdown_and_close()
that itself calls shutdown_ssl(). However, shutdown_ssl() is virtual
and C++ does not perform virtual dispatch in destructors, which results
in the wrong overload being called.
This change adds a non-virtual shutdown_ssl_impl() function that is
called from ~SSLClient(). We also inline sock_socket_and_shutdown_and_close()
and removes the virtual call in ~ClientImpl().
* Inline and remove lock_socket_and_shutdown_and_close()
The function only has one caller.
* Fix client.cc code, since res.error() without operator overloading causing error in Xcode
* Add unit test to check new error to string with operator overloading
* Add inline as requested in code review comment
* Special function to encode query params
* Fix #include <iomanip>
* Added unescaped charsets to encode_query_param
* Unit tests for encode_query_param
Add unit test for issue #682 fixed in PR #728, which does not contain
the test of its own.
The test creates a fake SSL server, inherited from SSLServer, which
does not create an SSL context. When an SSL client attempts to send it
a request, it gets a timeout error. Prior to PR #728, the client would
wait indefinitely
Co-authored-by: Michael Tseitlin <michael.tseitlin@concertio.com>
* ssl-verify-host: fix verifying ip addresses containing zero's
If the subject alternate name contained an ip address with an zero
(like 10.42.0.1) it could not successfully verify.
It is because in c++ strings are null-terminated
and therefore strlen(name) would return a wrong result.
As I can not see why we can not trust the length returned by openssl,
lets drop this check.
* ssl-verify-host: add test case
lets try to validate against 127.0.0.1
Co-authored-by: Daniel Ottiger <daniel.ottiger@ch.schindler.com>
SSL connection is performed in two steps:
First, a regular socket connection is established.
Then, SSL_connect/SSL_accept is called to establish SSL handshake.
If a network problem occurs during the second stage, SSL_connect on
the client may hang indefinitely.
The non-blocking mode solves this problem.
Co-authored-by: Michael Tseitlin <michael.tseitlin@concertio.com>
* *Add server fuzzer target and seed corpus
* Add fuzz_test option to Makefile
* Fix#685
* Try to fix Github actions on Ubuntu
* Added ReadTimeoutSSL test
* Comment out `-fsanitize=address`
* Rebase upstream changes
* remove address sanitizer temporarily
* Add separate Makefile for fuzzing
* 1. Remove special char from dictionary
2. Clean fuzzing/Makefile
* Use specific path to avoid accidently linking openssl version brought in by oss-fuzz
* remove addition of flags
* Refactor Makefile
* Add missing newline
* Add fuzztest to github workflow
* Fix
Co-authored-by: yhirose <yuji.hirose.bug@gmail.com>
* Backport std::make_unique from C++14.
* Replace shared_ptr with unique_ptr for better performance.
Co-authored-by: Ella <maxutong16@otcaix.iscas.ac.cn>
* Use move semantics instead of copy for functions
In some cases, a few more copies could be prevented by changing function definitions to accept parameters by const-ref, rather than by value, but I didn't want to change public signatures.
* Fix two use-after-move errors
* Add `cache_control` parameter to `set_mount_point`
Specifies the Cache-Control header value to return when specified. For example:
```
svr.set_mount_point("/assets", "public/assets", "public, max-age=604800, immutable");
```
* Add default for cache_control
Default to "no-cache", which is implicitly what is happening today.
* Change set_mount_point to accept Headers
* Don't use C++17 destructuring
* Fix memory leak due caused due to X509_STORE
* Add test for repro and address sanitizer to compiler flags
* Add comment
* Sync
* Associate ca_store with ssl context within set_ca_cert_store()
* Split SlowPost test
* Fix#674
Co-authored-by: yhirose <yuji.hirose.bug@gmail.com>
* Fix parsing to parse query string with single space char.
When passed ' ' as a query string, the server crashes cause of illegal memory access done in httplib::detail::split. Have added checks to make sure the split function has a valid string with length > 0.
* Fix parsing to parse query string with single space char.
* Fix server crash caused due to regex complexity while matching headers.
While parsing content-type header in multipart form request the server crashes due to the exhaustion of max iterations performed while matching the input string with content-type regex.
Have removed the regex which might use backtracking while matching and replaced it with manual string processing. Have added tests as well.
* Remove magic number
Co-authored-by: Ivan Fefer <fefer.ivan@gmail.com>
Co-authored-by: yhirose <yhirose@users.noreply.github.com>
Co-authored-by: Ivan Fefer <fefer.ivan@gmail.com>
* Fix parsing to parse query string with single space char.
When passed ' ' as a query string, the server crashes cause of illegal memory access done in httplib::detail::split. Have added checks to make sure the split function has a valid string with length > 0.
* Fix parsing to parse query string with single space char.
Correct the working directory of the execute_process call, to get the version from git tags.
The working directory should be the the directory of this libary. Otherwise, if you include httplib
as a git submodule and call add_subdirectory, the execute_process command will be run in a wrong
directory leading to error.
If you didn't have Git installed, execute_process never declared the
error variable, which led to it never parsing the header for a version.
So if Git wasn't installed, the version variable never got declared,
which caused errors.
This fixes that.
* Update httplib.h
When you disconnect and reconnect from the network, your network stack rewrites and updates /etc/resolv.conf accordingly. This configuration file is needed by the DNS resolver in the C library. The C library reads the DNS configuration from /etc/resolv.conf the first time, and caches it. It doesn't check, with every lookup, if the contents of /etc/resolv.conf have changed.
the solution is to add a call to res_init(), defined in resolv.h
* Update httplib.h
Had to create a custom FindBrotli package, as not all users have
PkgConfig installed (which Brotli uses). This file gets installed
alongside httplibConfig.cmake for the end-users convenience.
Set BROTLI_USE_STATIC_LIBS to ON if you want to find the static libs
instead of default shared.
Adds the HTTPLIB_REQUIRE_BROTLI (default off) and HTTPLIB_USE_BROTLI_IF_AVAILABLE
(default on) options, which work in the same manner as the other optional/required
dependency options.
Moved the scattered linking and definitions to a single call.
Updated some documentation about the new options.
Improved the in-tree support by setting the HTTPLIB_IS_USING_XYZ
variables in the main CMakeLists (as well as having them in the
httplibConfig.cmake file).
Fixes#582
Seems certain targets/hosts failed without these, as "_MSC_VER" is
undefined on MinGW, which caused the 'pragma comment(lib "libname")' to
fail.
Fixes#575
This gets us the full version (aka with the patch version), instead of
just major and minor version from user agent.
Falls back to the user agent if it fails.
It pulls the version from the user-agent string in the header, so it
will not need to be manually adjusted. This version file is installed so
that you can check for a specific version with find_package(httplib)
Also added HTTPLIB_INCLUDE_DIR (root path without header name), and
HTTPLIB_LIBRARY (only if compiled).
Added HTTPLIB_VERSION, and HTTPLIB_FOUND (although it's recommended
to check if the target exists).
Updated CMakeLists documentation for all this.
This option (default OFF) automatically splits the file (with split.py)
into a header & source file, then compiles it as a shared/static
library. This requires an installed Python v3 executable to work.
This also adds a HTTPLIB_IS_COMPILED boolean that's available after a
finfind_package(httplib) call.
Note that the minimum Cmake version increased to 3.12 because of FindPython3.
Hopefully this isn't a problem, as it's already 3 years old at this point.
* Revert "Removed CMakeLists.txt. (Fix#421)"
This reverts commit 8674555b88.
* Fail if cmake version too old
Previous behaviour is just a warning.
* Improve CMakeLists
Adds automatic dependency finding (if they were used).
Adds a way to require a specific version in the find_package(httplib) call.
You should link against the httplib::httplib IMPORTED target, which is
created automatically.
Add options to allow for strictly requiring OpenSSL/ZLIB
HTTPLIB_REQUIRE_OPENSSL & HTTPLIB_REQUIRE_ZLIB require the libs be found, or the build fails.
HTTPLIB_USE_OPENSSL_IF_AVAILABLE & HTTPLIB_USE_ZLIB_IF_AVAILABLE silently search for the libs.
If they aren't found, the build still continues, but shuts off support for those features.
* Add documentation to CMakeLists.txt
Has info on all the available options and what targets are produced.
Also put some things about installation on certain platforms.
In case we want to send a lot of data,
and the receiver is slower than the sender.
This will first fill up the receivers queues and after this
eventually also the senders queues,
until the socket is temporarily unable to accept more data to send.
select_write is done with an timeout of zero,
which makes the select call used always return immediately:
(see http://man7.org/linux/man-pages/man2/select.2.html)
This means that every marginal unavailability will make it return false
for is_writable and therefore httplib will immediately abort the transfer.
Therefore make this values configurable in the same way
as the read timeout already is.
Set the default write timeout to 5 seconds,
the same default value used for the read timeout.
According to RFC 3493 the socket option IPV6_V6ONLY
should be off by default, see
https://tools.ietf.org/html/rfc3493#page-22 (chapter 5.3).
However this does not seem to be the case on all systems.
For instance on any Windows OS, the option is on by default.
Therefore clear this option in order to allow
an server socket which can support IPv6 and IPv4 at the same time.
I use a custom TaskQueue, with variable number of workers, adding workers on demand is an easy task when new connection arrive (in enqueue function) however i need another funtion to be called even (or better) went no new connections arrives to reduce workers count. I only added a new virtual method in TaskQueue class to allow custom class to adjust workers size over time. Even if this methods is called frequenlty custom class can keep a "last_update" counter to check if need to adjust worker count or any other internal task. Without this function i need an external thread to make this adjust task.
* Fixed error:
ULONG_MAX is defined in the limits.h header file. Putting #include <climits>
```
httplib.h: In function ‘bool httplib::detail::read_content_chunked(httplib::Stream&, httplib::ContentReceiver)’:
httplib.h:1921:22: error: ‘ULONG_MAX’ was not declared in this scope
if (chunk_len == ULONG_MAX) { return false; }
^~~~~~~~~
httplib.h:1921:22: note: suggested alternative: ‘_SC_ULONG_MAX’
if (chunk_len == ULONG_MAX) { return false; }
^~~~~~~~~
_SC_ULONG_MAX
```
* Move #include <climits> to after #include <cassert>
We cannot trivially support such large chunks, and the maximum value
std::strtoul can parse accurately is ULONG_MAX-1. Error out early if the
length is longer than that.
detail::read_content_chunked was using std::stoul to parse the
hexadecimal chunk lengths for "Transfer-Encoding: chunked" requests.
This throws an exception if the string does not begin with any valid
digits. read_content_chunked is not called in the context of a try block
so this caused the process to terminate.
Rather than use exceptions, I opted for std::stroul, which is similar to
std::stoul but does not throw exceptions. Since malformed user input is
not particularly exceptional, and some projects are compiled without
exception support, this approach seems both more portable and more
correct.
* SSLServer: add constructor to pass ssl-certificates and key from memory
* SSLClient: add constructor to pass ssl-certificates and key from memory
* add TestCase for passing certificates from memory to SSLClient/SSLServer
Previously, calling set_content always resulted in 's' being copied. With this change, there will still be the same number of copies made (1) when doing `set_content(my_value, ...)`, but there will be no copies if a caller elects to do `set_content(std::move(value), ...)` or `set_content(some_function_that_returns_a_temporary(), ...)` instead.
The regex that parses header lines potentially causes an unlimited
amount of backtracking, which can cause an exception in the libc++ regex
engine.
The exception that occurs looks like this and is identical to the
message of the exception fixed in
https://github.com/yhirose/cpp-httplib/pull/280:
libc++abi.dylib: terminating with uncaught exception of type
std::__1::regex_error: The complexity of an attempted match
against a regular expression exceeded a pre-set level.
This commit eliminates the problematic backtracking.
Since the WSA_FLAG_NO_HANDLE_INHERIT is only supported on Windows 7 SP1 and above the socket creation fails on older Windows Systems.
Let's try to create a socket the old way in this case.
Reference:
https://docs.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasocketa
WSA_FLAG_NO_HANDLE_INHERIT:
This flag is supported on Windows 7 with SP1, Windows Server 2008 R2 with SP1, and later
libc++ (the implementation of the C++ standard library usually used by
Clang) throws an exception for the regex used by parse_headers before
this patch for certain strings. Work around this by simplifying the
regex and parsing the header lines "by hand" partially. I have repro'd
this problem with Xcode 11.1 which I believe uses libc++ version 8.
This may be a bug in libc++ as I can't see why the regex would result in
asymptotic run-time complexity for any strings. However, it may take a
while for libc++ to be fixed and for everyone to migrate to it, so it
makes sense to work around it in this codebase for now.
HTTP Whitespace and regex whitespace are not the same, so we can't use
\s in regexes when parsing HTTP headers. Instead, explicitly specify
what is considered whitespace in the regex.
- This compliments the existing `bind_to_any_port()`
where you can determine if the bind succeeded prior
to calling `listen_after_bind()` but allows you to
specify the port.
While trying to implement streaming of internet radio, where a ContentReceiver is needed to handle the audio data, I had the problem, that important information about the stream data is part of the HTTP header (e.g. size of audio chunks between meta data), so I added a ResponseHandler and a new Get variant, to gain access to the header before handling the first chunk of data.
The ResponseHandler can abort the request by returning false, in the same way as the ContentReceiver.
A test case was also added.
cd test && make test_split EXTRA_CXXFLAGS="-fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS" && make test_openssl_parallel EXTRA_CXXFLAGS="-fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS"
This document describes the streaming extensions for cpp-httplib, providing an iterator-style API for handling HTTP responses incrementally with **true socket-level streaming**.
> **Important Notes**:
>
> - **No Keep-Alive**: Each `stream::Get()` call uses a dedicated connection that is closed after the response is fully read. For connection reuse, use `Client::Get()`.
> - **Single iteration only**: The `next()` method can only iterate through the body once.
> - **Result is not thread-safe**: While `stream::Get()` can be called from multiple threads simultaneously, the returned `stream::Result` must be used from a single thread only.
## Overview
The streaming API allows you to process HTTP response bodies chunk by chunk using an iterator-style pattern. Data is read directly from the network socket, enabling low-memory processing of large responses. This is particularly useful for:
| SSE with auto-reconnect | SSEClient (planned) or `ssecli-stream.cc` example |
| LLM streaming (JSON Lines) | `stream::Get()` |
| Large file download | `stream::Get()` or `open_stream()` |
| Reverse proxy | `open_stream()` |
| Small responses with Keep-Alive | `Client::Get()` |
## API Reference
### Low-Level API: `StreamHandle`
The `StreamHandle` struct provides direct control over streaming responses. It takes ownership of the socket connection and reads data directly from the network.
> **Note:** When using `open_stream()`, the connection is dedicated to streaming and **Keep-Alive is not supported**. For Keep-Alive connections, use `client.Get()` instead.
A simple, blocking WebSocket implementation for C++11.
> [!IMPORTANT]
> This is a blocking I/O WebSocket implementation using a thread-per-connection model. If you need high-concurrency WebSocket support with non-blocking/async I/O (e.g., thousands of simultaneous connections), this is not the one that you want.
## Features
- **RFC 6455 compliant**: Full WebSocket protocol support
- **Server and Client**: Both sides included
- **SSL/TLS support**: `wss://` scheme for secure connections
- **Text and Binary**: Both message types supported
Returned by `read()`. Since `Fail` is `0`, the result works naturally in boolean contexts — `while (ws.read(msg))` continues until the connection closes. When you need to distinguish text from binary, check the return value directly.
The `SubProtocolSelector` receives the list of subprotocols proposed by the client (from the `Sec-WebSocket-Protocol` header) and returns the selected one. Return an empty string to decline all proposed subprotocols.
### WebSocket (Server-side)
Passed to the handler registered with `Server::WebSocket()`. The handler runs in a dedicated thread per connection.
```cpp
// Read next message (blocks until received, returns Fail/Text/Binary)
The server can negotiate a subprotocol with the client using `Sec-WebSocket-Protocol`. This is required for protocols like GraphQL over WebSocket (`graphql-ws`) and MQTT.
```cpp
// Server: register a handler with a subprotocol selector
WebSocket connections share the same thread pool as HTTP requests. Each WebSocket connection occupies one thread for its entire lifetime.
The default thread pool uses dynamic scaling: it maintains a base thread count of `CPPHTTPLIB_THREAD_POOL_COUNT` (8 or `std::thread::hardware_concurrency() - 1`, whichever is greater) and can scale up to 4x that count under load (`CPPHTTPLIB_THREAD_POOL_MAX_COUNT`). When all base threads are busy, temporary threads are spawned automatically up to the maximum. These dynamic threads exit after an idle timeout (`CPPHTTPLIB_THREAD_POOL_IDLE_TIMEOUT`, default 3 seconds).
This dynamic scaling helps accommodate WebSocket connections alongside HTTP requests. However, if you expect many simultaneous WebSocket connections, you should configure the thread pool accordingly:
[cpp-httplib](https://github.com/yhirose/cpp-httplib) is an HTTP/HTTPS library for C++. Just copy a single header file, [`httplib.h`](https://github.com/yhirose/cpp-httplib/raw/refs/tags/latest/httplib.h), and you're ready to go.
When you need a quick HTTP server or client in C++, you want something that just works. That's exactly why I built cpp-httplib. You can start writing both servers and clients in just a few lines of code.
The API uses a lambda-based design that feels natural. It runs anywhere you have a C++11 or later compiler. Windows, macOS, Linux — use whatever environment you already have.
HTTPS works too. Just link OpenSSL or mbedTLS, and both server and client gain TLS support. Content-Encoding (gzip, Brotli, etc.), file uploads, and other features you actually need in real-world development are all included. WebSocket is also supported.
Under the hood, it uses blocking I/O with a thread pool. It's not built for handling massive numbers of simultaneous connections. But for API servers, embedded HTTP in tools, mock servers for testing, and many other use cases, it delivers solid performance.
"Solve today's problem, today." That's the kind of simplicity cpp-httplib aims for.
## Documentation
- [A Tour of cpp-httplib](tour/) — A step-by-step tutorial covering the basics. Start here if you're new
- [Cookbook](cookbook/) — A collection of recipes organized by topic. Jump to whatever you need
- [Building a Desktop LLM App](llm-app/) — A hands-on guide to building a desktop app with llama.cpp, step by step
title: "Building a Desktop LLM App with cpp-httplib"
order: 0
---
Build an LLM-powered translation desktop app step by step, learning both the server and client sides of cpp-httplib along the way. Translation is just an example — swap it out to build your own summarizer, code generator, chatbot, or any other LLM application.
cpp-httplib isn't just for servers -- it also comes with a full HTTP client. Let's use `httplib::Client` to send GET and POST requests.
## Preparing a Test Server
To try out the client, you need a server that accepts requests. Save the following code, then compile and run it the same way you did in the previous chapter. We'll cover the server details in the next chapter.
std::cout<<"Listening on port 8080..."<<std::endl;
svr.listen("0.0.0.0",8080);
}
```
## GET Request
Once the server is running, open a separate terminal and give it a try. Let's start with the simplest GET request.
```cpp
#include"httplib.h"
#include<iostream>
intmain(){
httplib::Clientcli("http://localhost:8080");
autores=cli.Get("/hi");
if(res){
std::cout<<res->status<<std::endl;// 200
std::cout<<res->body<<std::endl;// Hello!
}
}
```
Pass the server address to the `httplib::Client` constructor, then call `Get()` to send a request. You can retrieve the status code and body from the returned `res`.
Here's the equivalent `curl` command.
```sh
curl http://localhost:8080/hi
# Hello!
```
## Checking the Response
A response contains header information in addition to the status code and body.
`res->body` is a `std::string`, so if you want to parse a JSON response, you can pass it directly to a JSON library like [nlohmann/json](https://github.com/nlohmann/json).
## Query Parameters
To add query parameters to a GET request, you can either write them directly in the URL or use `httplib::Params`.
In the previous chapter, you sent requests from a client to a test server. Now let's walk through how that server actually works.
## Starting the Server
Once you've registered your routes, call `svr.listen()` to start the server.
```cpp
svr.listen("0.0.0.0",8080);
```
The first argument is the host, and the second is the port. `"0.0.0.0"` listens on all network interfaces. Use `"127.0.0.1"` if you want to accept connections from your own machine only.
`listen()` is a blocking call. It won't return until the server stops. The server keeps running until you press `Ctrl+C` in your terminal or call `svr.stop()` from another thread.
## Routing
Routing is the heart of any server. It's how you tell cpp-httplib: when a request comes in for this URL with this HTTP method, run this code.
`svr.Get()` registers a handler for GET requests. The first argument is the path, the second is the handler function. When a GET request arrives at `/hi`, your lambda runs.
There's a method for each HTTP verb.
```cpp
svr.Get("/path",handler);// GET
svr.Post("/path",handler);// POST
svr.Put("/path",handler);// PUT
svr.Delete("/path",handler);// DELETE
```
The handler signature is `(const httplib::Request &req, httplib::Response &res)`. You can use `auto` to keep it short.
```cpp
svr.Get("/hi",[](constauto&req,auto&res){
res.set_content("Hello!","text/plain");
});
```
The handler only runs when the path matches. Requests to unregistered paths automatically return 404.
## The Request Object
The first parameter `req` gives you everything the client sent.
### Body
`req.body` holds the request body as a `std::string`.
```cpp
svr.Post("/post",[](constauto&req,auto&res){
// Echo the body back to the client
res.set_content(req.body,"text/plain");
});
```
### Headers
Use `req.get_header_value()` to read a request header.
```cpp
svr.Get("/check",[](constauto&req,auto&res){
autoauth=req.get_header_value("Authorization");
res.set_content("Auth: "+auth,"text/plain");
});
```
### Query Parameters and Form Data
`req.get_param_value()` retrieves a parameter by name. It works for both GET query parameters and POST form data.
```cpp
svr.Get("/search",[](constauto&req,auto&res){
autoq=req.get_param_value("q");
res.set_content("Query: "+q,"text/plain");
});
```
A request to `/search?q=cpp-httplib` gives you `"cpp-httplib"` for `q`.
To loop over all parameters, use `req.params`.
```cpp
svr.Post("/submit",[](constauto&req,auto&res){
std::stringresult;
for(auto&[key,val]:req.params){
result+=key+" = "+val+"\n";
}
res.set_content(result,"text/plain");
});
```
### File Uploads
Files uploaded via multipart form data are available through `req.form.get_file()`.
You can also write a regular expression directly in the path instead of `:param`. Capture group values are available via `req.matches`, which is a `std::smatch`.
Receives a file uploaded via multipart form data. `req.form.get_file("file")` fetches the field named `"file"`, and we respond with the filename and size.
### GET /users/:id
```cpp
svr.Get("/users/:id",[](constauto&req,auto&res){
autoid=req.path_params.at("id");
res.set_content("User ID: "+id,"text/plain");
});
```
`:id` is the path parameter. `req.path_params.at("id")` retrieves its value. `/users/42` gives you `"42"`, `/users/alice` gives you `"alice"`.
The regex `(\d+)` matches numeric IDs only. `/files/42` hits this handler, but `/files/abc` returns 404. `req.matches[1]` retrieves the first capture group.
## Next Steps
You now have the full picture of how a server works. Routing, reading requests, building responses -- that's enough to build a real API server.
Next, let's look at serving static files. We'll build a server that delivers HTML and CSS.
cpp-httplib can serve static files too — HTML, CSS, images, you name it. No complicated configuration required. One call to `set_mount_point()` is all it takes.
## The basics of set_mount_point
Let's jump right in. `set_mount_point()` maps a URL path to a local directory.
```cpp
#include"httplib.h"
#include<iostream>
intmain(){
httplib::Serversvr;
svr.set_mount_point("/","./html");
std::cout<<"Listening on port 8080..."<<std::endl;
svr.listen("0.0.0.0",8080);
}
```
The first argument is the URL mount point. The second is the local directory path. In this example, requests to `/` are served from the `./html` directory.
Let's try it out. First, create an `html` directory and add an `index.html` file.
```sh
mkdir html
```
```html
<!DOCTYPE html>
<html>
<head><title>My Page</title></head>
<body>
<h1>Hello from cpp-httplib!</h1>
<p>This is a static file.</p>
</body>
</html>
```
Compile and start the server.
```sh
g++ -std=c++17 -o server server.cpp -pthread
./server
```
Open `http://localhost:8080` in your browser. You should see the contents of `html/index.html`. Visiting `http://localhost:8080/index.html` returns the same page.
You can also access it with the client code from the previous chapter, or with `curl`.
```cpp
httplib::Clientcli("http://localhost:8080");
autores=cli.Get("/");
if(res){
std::cout<<res->body<<std::endl;// HTML is displayed
}
```
```sh
curl http://localhost:8080
```
## Multiple mount points
You can call `set_mount_point()` as many times as you like. Each URL path gets its own directory.
```cpp
svr.set_mount_point("/","./public");
svr.set_mount_point("/assets","./static/assets");
svr.set_mount_point("/docs","./documentation");
```
A request to `/assets/style.css` serves `./static/assets/style.css`. A request to `/docs/guide.html` serves `./documentation/guide.html`.
## Combining with handlers
Static file serving and routing handlers — the kind you learned about in the previous chapter — work side by side.
Handlers take priority. The handler responds to `/api/hello`. For every other path, the server looks for a file in `./public`.
## Adding response headers
Pass headers as the third argument to `set_mount_point()` and they get attached to every static file response. This is great for cache control.
```cpp
svr.set_mount_point("/","./public",{
{"Cache-Control","max-age=3600"}
});
```
With this in place, the browser caches served files for one hour.
## A Dockerfile for your static file server
The cpp-httplib repository includes a `Dockerfile` built for static file serving. We also publish a pre-built image on Docker Hub, so you can get up and running with a single command.
```sh
> docker run -p 8080:80 -v ./my-site:/html yhirose4dockerhub/cpp-httplib-server
Everything in your `./my-site` directory gets served on port 8080. The access log follows the same format as NGINX, so you can see exactly what's happening.
## What's next
You can now serve static files. A web server that delivers HTML, CSS, and JavaScript — built with this little code.
Next, let's encrypt your connections with HTTPS. We'll start by setting up a TLS library.
Compile and run it. If you see `Status: 200`, your setup is complete.
## Other TLS Backends
cpp-httplib also supports Mbed TLS and wolfSSL in addition to OpenSSL. You can switch between them just by changing the macro definition and linked libraries.
In the previous chapter, you set up OpenSSL. Now let's put it to use with an HTTPS client. You can use the same `httplib::Client` from Chapter 2. Just pass a URL with the `https://` scheme to the constructor.
## GET Request
Let's try accessing a real HTTPS site.
```cpp
#define CPPHTTPLIB_OPENSSL_SUPPORT
#include"httplib.h"
#include<iostream>
intmain(){
httplib::Clientcli("https://nghttp2.org");
autores=cli.Get("/");
if(res){
std::cout<<res->status<<std::endl;// 200
std::cout<<res->body.substr(0,100)<<std::endl;// First 100 chars of the HTML
In Chapter 2, you wrote `httplib::Client cli("http://localhost:8080")`. All you need to change is the scheme to `https://`. Every API you learned in Chapter 2 -- `Get()`, `Post()`, and so on -- works exactly the same way.
```sh
curl https://nghttp2.org/
```
## Specifying a Port
The default port for HTTPS is 443. If you need a different port, include it in the URL.
```cpp
httplib::Clientcli("https://localhost:8443");
```
## CA Certificate Verification
When connecting over HTTPS, `httplib::Client` verifies the server certificate by default. It only connects to servers whose certificate was issued by a trusted CA (Certificate Authority).
CA certificates are loaded automatically from the Keychain on macOS, the system CA certificate store on Linux, and the Windows certificate store on Windows. In most cases, no extra configuration is needed.
### Specifying a CA Certificate File
On some environments, the system CA certificates may not be found. In that case, use `set_ca_cert_path()` to specify the path directly.
In the previous chapter, you used an HTTPS client. Now let's set up your own HTTPS server. Just swap `httplib::Server` from Chapter 3 with `httplib::SSLServer`.
A TLS server needs a server certificate and a private key, though. Let's get those ready first.
## Creating a Self-Signed Certificate
For development and testing, a self-signed certificate works just fine. You can generate one quickly with an OpenSSL command.
Once you have your certificate, let's write the server.
```cpp
#define CPPHTTPLIB_OPENSSL_SUPPORT
#include"httplib.h"
#include<iostream>
intmain(){
httplib::SSLServersvr("cert.pem","key.pem");
svr.Get("/",[](constauto&,auto&res){
res.set_content("Hello, HTTPS!","text/plain");
});
std::cout<<"Listening on https://localhost:8443"<<std::endl;
svr.listen("0.0.0.0",8443);
}
```
Just pass the certificate and private key paths to the `httplib::SSLServer` constructor. The routing API is exactly the same as `httplib::Server` from Chapter 3.
Compile and start it up.
## Testing It Out
With the server running, try accessing it with `curl`. Since we're using a self-signed certificate, add the `-k` option to skip certificate verification.
```sh
curl -k https://localhost:8443/
# Hello, HTTPS!
```
If you open `https://localhost:8443` in a browser, you'll see a "This connection is not secure" warning. That's expected with a self-signed certificate. Just proceed past it.
## Connecting from a Client
Let's connect using `httplib::Client` from the previous chapter. There are two ways to connect to a server with a self-signed certificate.
### Option 1: Disable Certificate Verification
This is the quick and easy approach for development.
### Option 2: Specify the Self-Signed Certificate as a CA Certificate
This is the safer approach. You tell the client to trust `cert.pem` as a CA certificate.
```cpp
#define CPPHTTPLIB_OPENSSL_SUPPORT
#include"httplib.h"
#include<iostream>
intmain(){
httplib::Clientcli("https://localhost:8443");
cli.set_ca_cert_path("cert.pem");
autores=cli.Get("/");
if(res){
std::cout<<res->body<<std::endl;// Hello, HTTPS!
}
}
```
This way, only connections to the server with that specific certificate are allowed, preventing impersonation. Use this approach whenever possible, even in test environments.
## Comparing Server and SSLServer
The `httplib::Server` API you learned in Chapter 3 works exactly the same with `httplib::SSLServer`. The only difference is the constructor.
cpp-httplib supports WebSocket as well. Unlike HTTP request/response, WebSocket lets the server and client exchange messages in both directions. It's great for chat apps and real-time notifications.
Let's build an echo server and client right away.
## Echo Server
Here's an echo server that sends back whatever message it receives.
ws.send(msg); // Send back the received message as-is
}
});
std::cout << "Listening on port 8080..." << std::endl;
svr.listen("0.0.0.0", 8080);
}
```
You register a WebSocket handler with `svr.WebSocket()`. It works just like `svr.Get()` and `svr.Post()` from Chapter 3.
Inside the handler, `ws.read(msg)` waits for a message. When the connection closes, `read()` returns `false`, so the loop exits. `ws.send(msg)` sends a message back.
## Connecting from a Client
Let's connect to the server using `httplib::ws::WebSocketClient`.
Pass a URL in `ws://host:port/path` format to the constructor. Call `connect()` to start the connection, then use `send()` and `read()` to exchange messages.
## Text and Binary
WebSocket has two types of messages: text and binary. You can tell them apart by the return value of `read()`.
ws.send(msg.data(), msg.size()); // Send as binary
} else {
ws.send(msg); // Send as text
}
}
});
```
- `ws.send(const std::string &)` — sends as a text message
- `ws.send(const char *, size_t)` — sends as a binary message
The client-side API is the same.
## Accessing Request Information
You can read HTTP request information from the handshake through the first argument `req` in the handler. This is handy for checking authentication tokens.
Great job finishing the Tour! You now have a solid grasp of the cpp-httplib basics. But there's a lot more to explore. Here's a quick overview of features we didn't cover in the Tour, organized by category.
## Streaming API
When you're working with LLM streaming responses or downloading large files, you don't want to load the entire response into memory. Use `stream::Get()` to process data chunk by chunk.
```cpp
httplib::Client cli("http://localhost:11434");
auto result = httplib::stream::Get(cli, "/api/generate");
if (result) {
while (result.next()) {
std::cout.write(result.data(), result.size());
}
}
```
You can also pass a `content_receiver` callback to `Get()`. This approach works with Keep-Alive.
On the server side, you have `set_content_provider()` and `set_chunked_content_provider()`. Use the former when you know the size, and the latter when you don't.
This is a step-by-step tutorial that walks you through the basics of cpp-httplib. Each chapter builds on the previous one, so please read them in order starting from Chapter 1.
1. [Getting Started](01-getting-started) — Get httplib.h and build a Hello World server
2. [Basic Client](02-basic-client) — Send GET/POST requests and use path parameters
3. [Basic Server](03-basic-server) — Routing, path parameters, and building responses
option('disable_macosx_automatic_root_certificates',type:'boolean',value:false,description:'Disable loading system certs from the Apple Keychain on macOS')
option('non_blocking_getaddrinfo',type:'feature',value:'auto',description:'Enable asynchronous name lookup')
option('compile',type:'boolean',value:false,description:'Split the header into a compilable header & source file (requires python3)')
File diff suppressed because one or more lines are too long
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.