Release v0.33.0

Fix CI build errors
Improvement for Multipart Form Data
2026-06-08 18:30:49 +00:00 · 2026-02-21 08:43:49 -05:00 · 2026-02-21 08:14:47 -05:00 · 2026-02-20 23:15:01 -05:00 · 2026-02-20 16:22:01 -05:00 · 2026-02-20 15:45:04 -05:00
46 changed files with 20152 additions and 2849 deletions
@@ -29,6 +29,7 @@ jobs:
        git
        libbrotli-dev
        libssl-dev
+        libzstd-dev
        meson
        pkg-config
        python3
@@ -0,0 +1,51 @@
+name: Release Docker Image
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Fetch all history and tags
+
+      - name: Extract tag (manual)
+        if: github.event_name == 'workflow_dispatch'
+        id: set_tag_manual
+        run: |
+          # Checkout the latest tag and set output
+          git fetch --tags
+          LATEST_TAG=$(git describe --tags --abbrev=0)
+          git checkout $LATEST_TAG
+          echo "tag=${LATEST_TAG#v}" >> $GITHUB_OUTPUT
+
+      - name: Extract tag (release)
+        if: github.event_name == 'release'
+        id: set_tag_release
+        run: echo "tag=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64  # Build for both amd64 and arm64
+          # Use extracted tag without leading 'v'
+          tags: |
+            yhirose4dockerhub/cpp-httplib-server:latest
+            yhirose4dockerhub/cpp-httplib-server:${{ steps.set_tag_manual.outputs.tag || steps.set_tag_release.outputs.tag }}
@@ -75,21 +75,45 @@ jobs:
      (github.event_name == 'pull_request'  &&
       github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name) ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.test_linux == 'true')
+    strategy:
+      matrix:
+        tls_backend: [openssl, mbedtls, wolfssl]
+    name: ubuntu (${{ matrix.tls_backend }})
    steps:
      - name: checkout
        uses: actions/checkout@v4
-      - name: install libraries
+      - name: install common libraries
        run: |
-          sudo dpkg --add-architecture i386
          sudo apt-get update
-          sudo apt-get install -y libc6-dev${{ matrix.config.arch_suffix }} libstdc++-13-dev${{ matrix.config.arch_suffix }} \
-            libssl-dev${{ matrix.config.arch_suffix }} libcurl4-openssl-dev${{ matrix.config.arch_suffix }} \
-            zlib1g-dev${{ matrix.config.arch_suffix }} libbrotli-dev${{ matrix.config.arch_suffix }} \
-            libzstd-dev${{ matrix.config.arch_suffix }}
-      - name: build and run tests
-        run: cd test && make EXTRA_CXXFLAGS="${{ matrix.config.arch_flags }}"
+          sudo apt-get install -y libcurl4-openssl-dev zlib1g-dev libbrotli-dev libzstd-dev
+      - name: install OpenSSL
+        if: matrix.tls_backend == 'openssl'
+        run: sudo apt-get install -y libssl-dev
+      - name: install Mbed TLS
+        if: matrix.tls_backend == 'mbedtls'
+        run: sudo apt-get install -y libmbedtls-dev
+      - name: install wolfSSL
+        if: matrix.tls_backend == 'wolfssl'
+        run: sudo apt-get install -y libwolfssl-dev
+      - name: build and run tests (OpenSSL)
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_split && make test_openssl_parallel
+        env:
+          LSAN_OPTIONS: suppressions=lsan_suppressions.txt
+      - name: build and run tests (Mbed TLS)
+        if: matrix.tls_backend == 'mbedtls'
+        run: cd test && make test_split_mbedtls && make test_mbedtls_parallel
+      - name: build and run tests (wolfSSL)
+        if: matrix.tls_backend == 'wolfssl'
+        run: cd test && make test_split_wolfssl && make test_wolfssl_parallel
      - name: run fuzz test target
-        run: cd test && make EXTRA_CXXFLAGS="${{ matrix.config.arch_flags }}" fuzz_test
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make fuzz_test
+      - name: build and run WebSocket heartbeat test
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_websocket_heartbeat && ./test_websocket_heartbeat
+      - name: build and run ThreadPool test
+        run: cd test && make test_thread_pool && ./test_thread_pool

  macos:
    runs-on: macos-latest
@@ -98,13 +122,38 @@ jobs:
      (github.event_name == 'pull_request'  &&
       github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name) ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.test_macos == 'true')
+    strategy:
+      matrix:
+        tls_backend: [openssl, mbedtls, wolfssl]
+    name: macos (${{ matrix.tls_backend }})
    steps:
      - name: checkout
        uses: actions/checkout@v4
-      - name: build and run tests
-        run: cd test && make
+      - name: install Mbed TLS
+        if: matrix.tls_backend == 'mbedtls'
+        run: brew install mbedtls@3
+      - name: install wolfSSL
+        if: matrix.tls_backend == 'wolfssl'
+        run: brew install wolfssl
+      - name: build and run tests (OpenSSL)
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_split && make test_openssl_parallel
+        env:
+          LSAN_OPTIONS: suppressions=lsan_suppressions.txt
+      - name: build and run tests (Mbed TLS)
+        if: matrix.tls_backend == 'mbedtls'
+        run: cd test && make test_split_mbedtls && make test_mbedtls_parallel
+      - name: build and run tests (wolfSSL)
+        if: matrix.tls_backend == 'wolfssl'
+        run: cd test && make test_split_wolfssl && make test_wolfssl_parallel
      - name: run fuzz test target
+        if: matrix.tls_backend == 'openssl'
        run: cd test && make fuzz_test
+      - name: build and run WebSocket heartbeat test
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_websocket_heartbeat && ./test_websocket_heartbeat
+      - name: build and run ThreadPool test
+        run: cd test && make test_thread_pool && ./test_thread_pool

  windows:
    runs-on: windows-latest
@@ -144,7 +193,14 @@ jobs:
          core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
    - name: Setup msbuild on windows
      uses: microsoft/setup-msbuild@v2
+    - name: Cache vcpkg packages
+      id: vcpkg-cache
+      uses: actions/cache@v4
+      with:
+        path: C:/vcpkg/installed
+        key: vcpkg-installed-windows-gtest-curl-zlib-brotli-zstd
    - name: Install vcpkg dependencies
+      if: steps.vcpkg-cache.outputs.cache-hit != 'true'
      run: vcpkg install gtest curl zlib brotli zstd
    - name: Install OpenSSL
      if: ${{ matrix.config.with_ssl }}
@@ -156,6 +212,7 @@ jobs:
        -DCMAKE_TOOLCHAIN_FILE=${{ env.VCPKG_ROOT }}/scripts/buildsystems/vcpkg.cmake
        -DHTTPLIB_TEST=ON
        -DHTTPLIB_COMPILE=${{ matrix.config.compiled && 'ON' || 'OFF' }}
+        -DHTTPLIB_USE_OPENSSL_IF_AVAILABLE=${{ matrix.config.with_ssl && 'ON' || 'OFF' }}
        -DHTTPLIB_REQUIRE_ZLIB=ON
        -DHTTPLIB_REQUIRE_BROTLI=ON
        -DHTTPLIB_REQUIRE_ZSTD=ON
@@ -164,7 +221,37 @@ jobs:
      run: cmake --build build --config Release -- /v:m /clp:ShowCommandLine
    - name: Run tests ${{ matrix.config.name }}
      if: ${{ matrix.config.run_tests }}
-      run: ctest --output-on-failure --test-dir build -C Release
+      shell: pwsh
+      working-directory: build/test
+      run: |
+        $shards = 4
+        $procs = @()
+        for ($i = 0; $i -lt $shards; $i++) {
+          $log = "shard_${i}.log"
+          $procs += Start-Process -FilePath ./Release/httplib-test.exe `
+            -ArgumentList "--gtest_color=yes","--gtest_filter=${{ github.event.inputs.gtest_filter || '*' }}-*BenchmarkTest*" `
+            -NoNewWindow -PassThru -RedirectStandardOutput $log -RedirectStandardError "${log}.err" `
+            -Environment @{ GTEST_TOTAL_SHARDS="$shards"; GTEST_SHARD_INDEX="$i" }
+        }
+        $procs | Wait-Process
+        $failed = $false
+        for ($i = 0; $i -lt $shards; $i++) {
+          $log = "shard_${i}.log"
+          if (Select-String -Path $log -Pattern "\[  PASSED  \]" -Quiet) {
+            $passed = (Select-String -Path $log -Pattern "\[  PASSED  \]").Line
+            Write-Host "Shard ${i}: $passed"
+          } else {
+            Write-Host "=== Shard $i FAILED ==="
+            Get-Content $log
+            if (Test-Path "${log}.err") { Get-Content "${log}.err" }
+            $failed = $true
+          }
+        }
+        if ($failed) { exit 1 }
+        Write-Host "All shards passed."
+    - name: Run benchmark tests with retry ${{ matrix.config.name }}
+      if: ${{ matrix.config.run_tests }}
+      run: ctest --output-on-failure --test-dir build -C Release -R "BenchmarkTest" --repeat until-pass:5

    env:
      VCPKG_ROOT: "C:/vcpkg"
@@ -0,0 +1,20 @@
+name: No Exceptions Test
+
+on: [push, pull_request]
+
+jobs:
+  test-no-exceptions:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Install dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y build-essential libssl-dev zlib1g-dev libcurl4-openssl-dev libbrotli-dev libzstd-dev
+
+    - name: Run tests with CPPHTTPLIB_NO_EXCEPTIONS
+      run: |
+        cd test && make test_split EXTRA_CXXFLAGS="-fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS" && make test_openssl_parallel EXTRA_CXXFLAGS="-fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS"
@@ -0,0 +1,62 @@
+name: test_offline
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      test_linux:
+        description: 'Test on Linux'
+        type: boolean
+        default: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  GTEST_FILTER: "-*.*_Online"
+
+jobs:
+  ubuntu:
+    runs-on: ubuntu-latest
+    if: >
+      (github.event_name == 'push') ||
+      (github.event_name == 'pull_request'  &&
+       github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name) ||
+      (github.event_name == 'workflow_dispatch' && github.event.inputs.test_linux == 'true')
+    strategy:
+      matrix:
+        tls_backend: [openssl, no-tls]
+    name: ubuntu (${{ matrix.tls_backend }})
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: install common libraries
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libcurl4-openssl-dev zlib1g-dev libbrotli-dev libzstd-dev
+      - name: install OpenSSL
+        if: matrix.tls_backend == 'openssl'
+        run: sudo apt-get install -y libssl-dev
+      - name: disable network
+        run: |
+          sudo iptables -A OUTPUT -o lo -j ACCEPT
+          sudo iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+          sudo iptables -A OUTPUT -j REJECT
+          sudo ip6tables -A OUTPUT -o lo -j ACCEPT
+          sudo ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+          sudo ip6tables -A OUTPUT -j REJECT
+      - name: build and run tests (OpenSSL)
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_split && make test_openssl_parallel
+        env:
+          LSAN_OPTIONS: suppressions=lsan_suppressions.txt
+      - name: build and run tests (No TLS)
+        if: matrix.tls_backend == 'no-tls'
+        run: cd test && make test_no_tls_parallel
+      - name: restore network
+        if: always()
+        run: |
+          sudo iptables -F OUTPUT
+          sudo ip6tables -F OUTPUT
@@ -6,15 +6,28 @@ jobs:
  test-proxy:
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
-    
+    strategy:
+      matrix:
+        tls_backend: [openssl, mbedtls]
+    name: proxy (${{ matrix.tls_backend }})
+
    steps:
-    - uses: actions/checkout@v3
-    
-    - name: Install dependencies
+    - uses: actions/checkout@v4
+
+    - name: Install common dependencies
      run: |
        sudo apt-get update
-        sudo apt-get install -y build-essential libssl-dev zlib1g-dev libcurl4-openssl-dev libbrotli-dev libzstd-dev netcat-openbsd
-        
-    - name: Run proxy tests
-      run: |
-        cd test && make proxy
+        sudo apt-get install -y build-essential zlib1g-dev libcurl4-openssl-dev libbrotli-dev libzstd-dev netcat-openbsd
+    - name: Install OpenSSL
+      if: matrix.tls_backend == 'openssl'
+      run: sudo apt-get install -y libssl-dev
+    - name: Install Mbed TLS
+      if: matrix.tls_backend == 'mbedtls'
+      run: sudo apt-get install -y libmbedtls-dev
+
+    - name: Run proxy tests (OpenSSL)
+      if: matrix.tls_backend == 'openssl'
+      run: cd test && make proxy
+    - name: Run proxy tests (Mbed TLS)
+      if: matrix.tls_backend == 'mbedtls'
+      run: cd test && make proxy_mbedtls
@@ -1,28 +1,59 @@
 tags

+# Ignore executables (no extension) but not source files
 example/server
+!example/server.*
 example/client
+!example/client.*
 example/hello
+!example/hello.*
 example/simplecli
+!example/simplecli.*
 example/simplesvr
+!example/simplesvr.*
 example/benchmark
+!example/benchmark.*
 example/redirect
-example/sse*
+!example/redirect.*
+example/ssecli
+!example/ssecli.*
+example/ssecli-stream
+!example/ssecli-stream.*
+example/ssesvr
+!example/ssesvr.*
 example/upload
+!example/upload.*
 example/one_time_request
+!example/one_time_request.*
 example/server_and_client
+!example/server_and_client.*
+example/accept_header
+!example/accept_header.*
+example/wsecho
+!example/wsecho.*
 example/*.pem
 test/httplib.cc
 test/httplib.h
 test/test
+test/test_mbedtls
+test/test_wolfssl
+test/test_no_tls
 test/server_fuzzer
 test/test_proxy
+test/test_proxy_mbedtls
+test/test_proxy_wolfssl
 test/test_split
+test/test_split_mbedtls
+test/test_split_wolfssl
+test/test_split_no_tls
+test/test_websocket_heartbeat
+test/test_thread_pool
 test/test.xcodeproj/xcuser*
 test/test.xcodeproj/*/xcuser*
 test/*.o
 test/*.pem
 test/*.srl
+test/*.log
 test/_build_*
 work/
 benchmark/server*
@@ -1,10 +1,11 @@
 #[[
 	Build options:
-	* BUILD_SHARED_LIBS (default off) builds as a shared library (if HTTPLIB_COMPILE is ON)
+	* Standard BUILD_SHARED_LIBS is supported and sets HTTPLIB_SHARED default value.
 	* HTTPLIB_USE_OPENSSL_IF_AVAILABLE (default on)
 	* HTTPLIB_USE_ZLIB_IF_AVAILABLE (default on)
 	* HTTPLIB_USE_BROTLI_IF_AVAILABLE (default on)
 	* HTTPLIB_USE_ZSTD_IF_AVAILABLE (default on)
+	* HTTPLIB_BUILD_MODULES (default off)
 	* HTTPLIB_REQUIRE_OPENSSL (default off)
 	* HTTPLIB_REQUIRE_ZLIB (default off)
 	* HTTPLIB_REQUIRE_BROTLI (default off)
@@ -13,6 +14,7 @@
 	* HTTPLIB_USE_NON_BLOCKING_GETADDRINFO (default on)
 	* HTTPLIB_COMPILE (default off)
 	* HTTPLIB_INSTALL (default on)
+	* HTTPLIB_SHARED (default off) builds as a shared library (if HTTPLIB_COMPILE is ON)
 	* HTTPLIB_TEST (default off)
 	* BROTLI_USE_STATIC_LIBS - tells Cmake to use the static Brotli libs (only works if you have them installed).
 	* OPENSSL_USE_STATIC_LIBS - tells Cmake to use the static OpenSSL libs (only works if you have them installed).
@@ -109,12 +111,43 @@ option(HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN "Enable feature to load system cer
 option(HTTPLIB_USE_NON_BLOCKING_GETADDRINFO "Enables the non-blocking alternatives for getaddrinfo." ON)
 option(HTTPLIB_REQUIRE_ZSTD "Requires ZSTD to be found & linked, or fails build." OFF)
 option(HTTPLIB_USE_ZSTD_IF_AVAILABLE "Uses ZSTD (if available) to enable zstd support." ON)
-# Defaults to static library
-option(BUILD_SHARED_LIBS "Build the library as a shared library instead of static. Has no effect if using header-only." OFF)
-if (BUILD_SHARED_LIBS AND WIN32 AND HTTPLIB_COMPILE)
-	# Necessary for Windows if building shared libs
-	# See https://stackoverflow.com/a/40743080
-	set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS ON)
+# C++20 modules support requires CMake 3.28 or later
+if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.28")
+	option(HTTPLIB_BUILD_MODULES "Build httplib modules (requires HTTPLIB_COMPILE to be ON)." OFF)
+else()
+	set(HTTPLIB_BUILD_MODULES OFF CACHE INTERNAL "Build httplib modules disabled (requires CMake 3.28+)" FORCE)
+	if(DEFINED CACHE{HTTPLIB_BUILD_MODULES} AND HTTPLIB_BUILD_MODULES)
+		message(WARNING "HTTPLIB_BUILD_MODULES requires CMake 3.28 or later. Current version is ${CMAKE_VERSION}. Modules support has been disabled.")
+	endif()
+endif()
+# Defaults to static library but respects standard BUILD_SHARED_LIBS if set
+include(CMakeDependentOption)
+cmake_dependent_option(HTTPLIB_SHARED "Build the library as a shared library instead of static. Has no effect if using header-only."
+	"${BUILD_SHARED_LIBS}" HTTPLIB_COMPILE OFF
+)
+if(HTTPLIB_SHARED)
+	set(HTTPLIB_LIB_TYPE SHARED)
+	if(WIN32)
+		# Necessary for Windows if building shared libs
+		# See https://stackoverflow.com/a/40743080
+		set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS ON)
+	endif()
+else()
+	set(HTTPLIB_LIB_TYPE STATIC)
+endif()
+
+if(CMAKE_SYSTEM_NAME MATCHES "Windows")
+	if(CMAKE_SYSTEM_VERSION)
+		if(${CMAKE_SYSTEM_VERSION} VERSION_LESS "10.0.0")
+			message(SEND_ERROR "Windows ${CMAKE_SYSTEM_VERSION} or lower is not supported. Please use Windows 10 or later.")
+		endif()
+	else()
+		set(CMAKE_SYSTEM_VERSION "10.0.19041.0")
+		message(WARNING "The target is Windows but CMAKE_SYSTEM_VERSION is not set, the default system version is set to Windows 10.")
+	endif()
+endif()
+if(CMAKE_SIZEOF_VOID_P LESS 8)
+	message(WARNING "Pointer size ${CMAKE_SIZEOF_VOID_P} is not supported. Please use a 64-bit compiler.")
 endif()

 # Set some variables that are used in-tree and while building based on our options
@@ -162,8 +195,11 @@ elseif(HTTPLIB_USE_BROTLI_IF_AVAILABLE)
 	set(HTTPLIB_IS_USING_BROTLI ${Brotli_FOUND})
 endif()

+# NOTE:
+# zstd < 1.5.6 does not provide the CMake imported target `zstd::libzstd`.
+# Older versions must be consumed via their pkg-config file.
 if(HTTPLIB_REQUIRE_ZSTD)
-	find_package(zstd)
+	find_package(zstd 1.5.6 CONFIG)
 	if(NOT zstd_FOUND)
 		find_package(PkgConfig REQUIRED)
 		pkg_check_modules(zstd REQUIRED IMPORTED_TARGET libzstd)
@@ -171,7 +207,7 @@ if(HTTPLIB_REQUIRE_ZSTD)
 	endif()
 	set(HTTPLIB_IS_USING_ZSTD TRUE)
 elseif(HTTPLIB_USE_ZSTD_IF_AVAILABLE)
-	find_package(zstd QUIET)
+	find_package(zstd 1.5.6 CONFIG QUIET)
 	if(NOT zstd_FOUND)
 		find_package(PkgConfig QUIET)
 		if(PKG_CONFIG_FOUND)
@@ -214,15 +250,37 @@ if(HTTPLIB_COMPILE)
 		message(FATAL_ERROR "Failed when trying to split cpp-httplib with the Python script.\n${_httplib_split_error}")
 	endif()

+	# If building modules, also generate the module file
+	if(HTTPLIB_BUILD_MODULES)
+		# Put the generate_module script into the build dir
+		configure_file(generate_module.py "${CMAKE_CURRENT_BINARY_DIR}/generate_module.py"
+			COPYONLY
+		)
+		# Generate the module file
+		execute_process(COMMAND ${Python3_EXECUTABLE} "${CMAKE_CURRENT_BINARY_DIR}/generate_module.py"
+			WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+			ERROR_VARIABLE _httplib_module_error
+		)
+		if(_httplib_module_error)
+			message(FATAL_ERROR "Failed when trying to generate cpp-httplib module with the Python script.\n${_httplib_module_error}")
+		endif()
+	endif()
+
 	# split.py puts output in "out"
 	set(_httplib_build_includedir "${CMAKE_CURRENT_BINARY_DIR}/out")
-	# This will automatically be either static or shared based on the value of BUILD_SHARED_LIBS
-	add_library(${PROJECT_NAME} "${_httplib_build_includedir}/httplib.cc")
+	add_library(${PROJECT_NAME} ${HTTPLIB_LIB_TYPE} "${_httplib_build_includedir}/httplib.cc")
 	target_sources(${PROJECT_NAME}
 		PUBLIC
 			$<BUILD_INTERFACE:${_httplib_build_includedir}/httplib.h>
 			$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}/httplib.h>
 	)
+	
+	# Add C++20 module support if requested
+	# Include from separate file to prevent parse errors on older CMake versions
+	if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.28")
+		include(cmake/modules.cmake)
+	endif()
+	
 	set_target_properties(${PROJECT_NAME}
 		PROPERTIES
 			VERSION ${${PROJECT_NAME}_VERSION}
@@ -239,22 +297,28 @@ endif()
 # Only useful if building in-tree, versus using it from an installation.
 add_library(${PROJECT_NAME}::${PROJECT_NAME} ALIAS ${PROJECT_NAME})

-# Require C++11
-target_compile_features(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC} cxx_std_11)
+# Require C++11, or C++20 if modules are enabled
+if(HTTPLIB_BUILD_MODULES)
+	target_compile_features(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC} cxx_std_20)
+else()
+	target_compile_features(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC} cxx_std_11)
+endif()

 target_include_directories(${PROJECT_NAME} SYSTEM ${_INTERFACE_OR_PUBLIC}
-    $<BUILD_INTERFACE:${_httplib_build_includedir}>
-    $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
+	$<BUILD_INTERFACE:${_httplib_build_includedir}>
+	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
 )

-# Always require threads
 target_link_libraries(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC}
+		# Always require threads
 		Threads::Threads
 		# Needed for Windows libs on Mingw, as the pragma comment(lib, "xyz") aren't triggered.
 		$<$<PLATFORM_ID:Windows>:ws2_32>
 		$<$<PLATFORM_ID:Windows>:crypt32>
 		# Needed for API from MacOS Security framework
-		"$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>,$<BOOL:${HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN}>>:-framework CoreFoundation -framework Security>"
+		"$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>,$<BOOL:${HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN}>>:-framework CFNetwork -framework CoreFoundation -framework Security>"
+		# Needed for non-blocking getaddrinfo on MacOS
+		"$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_USE_NON_BLOCKING_GETADDRINFO}>>:-framework CFNetwork -framework CoreFoundation>"
 		# Can't put multiple targets in a single generator expression or it bugs out.
 		$<$<BOOL:${HTTPLIB_IS_USING_BROTLI}>:Brotli::common>
 		$<$<BOOL:${HTTPLIB_IS_USING_BROTLI}>:Brotli::encoder>
@@ -310,7 +374,11 @@ if(HTTPLIB_INSTALL)
 	# Creates the export httplibTargets.cmake
 	# This is strictly what holds compilation requirements
 	# and linkage information (doesn't find deps though).
-	install(TARGETS ${PROJECT_NAME} EXPORT httplibTargets)
+	if(HTTPLIB_BUILD_MODULES)
+		install(TARGETS ${PROJECT_NAME} EXPORT httplibTargets FILE_SET CXX_MODULES DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/httplib/modules CXX_MODULES_BMI DESTINATION ${CMAKE_INSTALL_LIBDIR}/httplib/modules)
+	else()
+		install(TARGETS ${PROJECT_NAME} EXPORT httplibTargets)
+	endif()

 	install(FILES "${_httplib_build_includedir}/httplib.h" TYPE INCLUDE)

@@ -339,7 +407,11 @@ if(HTTPLIB_INSTALL)
 	include(CPack)
 endif()

-if(HTTPLIB_TEST)
-    include(CTest)
-    add_subdirectory(test)
+if(HTTPLIB_BUILD_MODULES AND NOT HTTPLIB_COMPILE)
+	message(FATAL_ERROR "HTTPLIB_BUILD_MODULES requires HTTPLIB_COMPILE to be ON.")
+endif()
+
+if(HTTPLIB_TEST)
+	include(CTest)
+	add_subdirectory(test)
 endif()
@@ -8,4 +8,6 @@ FROM scratch
 COPY --from=builder /build/server /server
 COPY docker/html/index.html /html/index.html
 EXPOSE 80
-CMD ["/server"]
+
+ENTRYPOINT ["/server"]
+CMD ["--host", "0.0.0.0", "--port", "80", "--mount", "/:./html"]
@@ -0,0 +1,182 @@
+# SSEClient - Server-Sent Events Client
+
+A simple, EventSource-like SSE client for C++11.
+
+## Features
+
+- **Auto-reconnect**: Automatically reconnects on connection loss
+- **Last-Event-ID**: Sends last received ID on reconnect for resumption
+- **retry field**: Respects server's reconnect interval
+- **Event types**: Supports custom event types via `on_event()`
+- **Async support**: Run in background thread with `start_async()`
+- **C++11 compatible**: No C++14/17/20 features required
+
+## Quick Start
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << "Event: " << msg.event << std::endl;
+    std::cout << "Data: " << msg.data << std::endl;
+});
+
+sse.start();  // Blocking, with auto-reconnect
+```
+
+## API Reference
+
+### SSEMessage
+
+```cpp
+struct SSEMessage {
+    std::string event;  // Event type (default: "message")
+    std::string data;   // Event payload
+    std::string id;     // Event ID
+};
+```
+
+### SSEClient
+
+#### Constructor
+
+```cpp
+// Basic
+SSEClient(Client &client, const std::string &path);
+
+// With custom headers
+SSEClient(Client &client, const std::string &path, const Headers &headers);
+```
+
+#### Event Handlers
+
+```cpp
+// Called for all events (or events without a specific handler)
+sse.on_message([](const SSEMessage &msg) { });
+
+// Called for specific event types
+sse.on_event("update", [](const SSEMessage &msg) { });
+sse.on_event("delete", [](const SSEMessage &msg) { });
+
+// Called when connection is established
+sse.on_open([]() { });
+
+// Called on connection errors
+sse.on_error([](httplib::Error err) { });
+```
+
+#### Configuration
+
+```cpp
+// Set reconnect interval (default: 3000ms)
+sse.set_reconnect_interval(5000);
+
+// Set max reconnect attempts (default: 0 = unlimited)
+sse.set_max_reconnect_attempts(10);
+```
+
+#### Control
+
+```cpp
+// Blocking start with auto-reconnect
+sse.start();
+
+// Non-blocking start (runs in background thread)
+sse.start_async();
+
+// Stop the client (thread-safe)
+sse.stop();
+```
+
+#### State
+
+```cpp
+bool connected = sse.is_connected();
+const std::string &id = sse.last_event_id();
+```
+
+## Examples
+
+### Basic Usage
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << msg.data << std::endl;
+});
+
+sse.start();
+```
+
+### With Custom Event Types
+
+```cpp
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_event("notification", [](const httplib::sse::SSEMessage &msg) {
+    std::cout << "Notification: " << msg.data << std::endl;
+});
+
+sse.on_event("update", [](const httplib::sse::SSEMessage &msg) {
+    std::cout << "Update: " << msg.data << std::endl;
+});
+
+sse.start();
+```
+
+### Async with Stop
+
+```cpp
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << msg.data << std::endl;
+});
+
+sse.start_async();  // Returns immediately
+
+// ... do other work ...
+
+sse.stop();  // Stop when done
+```
+
+### With Custom Headers (e.g., Authentication)
+
+```cpp
+httplib::Headers headers = {
+    {"Authorization", "Bearer token123"}
+};
+
+httplib::sse::SSEClient sse(cli, "/events", headers);
+sse.start();
+```
+
+### Error Handling
+
+```cpp
+sse.on_error([](httplib::Error err) {
+    std::cerr << "Error: " << httplib::to_string(err) << std::endl;
+});
+
+sse.set_reconnect_interval(1000);
+sse.set_max_reconnect_attempts(5);
+
+sse.start();
+```
+
+## SSE Protocol
+
+The client parses SSE format according to the [W3C specification](https://html.spec.whatwg.org/multipage/server-sent-events.html):
+
+```
+event: custom-type
+id: 123
+data: {"message": "hello"}
+
+data: simple message
+
+: this is a comment (ignored)
+```
@@ -0,0 +1,317 @@
+# cpp-httplib Streaming API
+
+This document describes the streaming extensions for cpp-httplib, providing an iterator-style API for handling HTTP responses incrementally with **true socket-level streaming**.
+
+> **Important Notes**:
+>
+> - **No Keep-Alive**: Each `stream::Get()` call uses a dedicated connection that is closed after the response is fully read. For connection reuse, use `Client::Get()`.
+> - **Single iteration only**: The `next()` method can only iterate through the body once.
+> - **Result is not thread-safe**: While `stream::Get()` can be called from multiple threads simultaneously, the returned `stream::Result` must be used from a single thread only.
+
+## Overview
+
+The streaming API allows you to process HTTP response bodies chunk by chunk using an iterator-style pattern. Data is read directly from the network socket, enabling low-memory processing of large responses. This is particularly useful for:
+
+- **LLM/AI streaming responses** (e.g., ChatGPT, Claude, Ollama)
+- **Server-Sent Events (SSE)**
+- **Large file downloads** with progress tracking
+- **Reverse proxy implementations**
+
+## Quick Start
+
+```cpp
+#include "httplib.h"
+
+int main() {
+    httplib::Client cli("http://localhost:8080");
+    
+    // Get streaming response
+    auto result = httplib::stream::Get(cli, "/stream");
+    
+    if (result) {
+        // Process response body in chunks
+        while (result.next()) {
+            std::cout.write(result.data(), result.size());
+        }
+    }
+    
+    return 0;
+}
+```
+
+## API Layers
+
+cpp-httplib provides multiple API layers for different use cases:
+
+```text
+┌─────────────────────────────────────────────┐
+│  SSEClient (planned)                        │  ← SSE-specific, parsed events
+│  - on_message(), on_event()                 │
+│  - Auto-reconnect, Last-Event-ID            │
+├─────────────────────────────────────────────┤
+│  stream::Get() / stream::Result             │  ← Iterator-based streaming
+│  - while (result.next()) { ... }            │
+├─────────────────────────────────────────────┤
+│  open_stream() / StreamHandle               │  ← General-purpose streaming
+│  - handle.read(buf, len)                    │
+├─────────────────────────────────────────────┤
+│  Client::Get()                              │  ← Traditional, full buffering
+└─────────────────────────────────────────────┘
+```
+
+| Use Case | Recommended API |
+|----------|----------------|
+| SSE with auto-reconnect | SSEClient (planned) or `ssecli-stream.cc` example |
+| LLM streaming (JSON Lines) | `stream::Get()` |
+| Large file download | `stream::Get()` or `open_stream()` |
+| Reverse proxy | `open_stream()` |
+| Small responses with Keep-Alive | `Client::Get()` |
+
+## API Reference
+
+### Low-Level API: `StreamHandle`
+
+The `StreamHandle` struct provides direct control over streaming responses. It takes ownership of the socket connection and reads data directly from the network.
+
+> **Note:** When using `open_stream()`, the connection is dedicated to streaming and **Keep-Alive is not supported**. For Keep-Alive connections, use `client.Get()` instead.
+
+```cpp
+// Open a stream (takes ownership of socket)
+httplib::Client cli("http://localhost:8080");
+auto handle = cli.open_stream("GET", "/path");
+
+// Check validity
+if (handle.is_valid()) {
+    // Access response headers immediately
+    int status = handle.response->status;
+    auto content_type = handle.response->get_header_value("Content-Type");
+    
+    // Read body incrementally
+    char buf[4096];
+    ssize_t n;
+    while ((n = handle.read(buf, sizeof(buf))) > 0) {
+        process(buf, n);
+    }
+}
+```
+
+#### StreamHandle Members
+
+| Member | Type | Description |
+|--------|------|-------------|
+| `response` | `std::unique_ptr<Response>` | HTTP response with headers |
+| `error` | `Error` | Error code if request failed |
+| `is_valid()` | `bool` | Returns true if response is valid |
+| `read(buf, len)` | `ssize_t` | Read up to `len` bytes directly from socket |
+| `get_read_error()` | `Error` | Get the last read error |
+| `has_read_error()` | `bool` | Check if a read error occurred |
+
+### High-Level API: `stream::Get()` and `stream::Result`
+
+The `httplib.h` header provides a more ergonomic iterator-style API.
+
+```cpp
+#include "httplib.h"
+
+httplib::Client cli("http://localhost:8080");
+cli.set_follow_location(true);
+...
+
+// Simple GET
+auto result = httplib::stream::Get(cli, "/path");
+
+// GET with custom headers
+httplib::Headers headers = {{"Authorization", "Bearer token"}};
+auto result = httplib::stream::Get(cli, "/path", headers);
+
+// Process the response
+if (result) {
+    while (result.next()) {
+        process(result.data(), result.size());
+    }
+}
+
+// Or read entire body at once
+auto result2 = httplib::stream::Get(cli, "/path");
+if (result2) {
+    std::string body = result2.read_all();
+}
+```
+
+#### stream::Result Members
+
+| Member | Type | Description |
+|--------|------|-------------|
+| `operator bool()` | `bool` | Returns true if response is valid |
+| `is_valid()` | `bool` | Same as `operator bool()` |
+| `status()` | `int` | HTTP status code |
+| `headers()` | `const Headers&` | Response headers |
+| `get_header_value(key, def)` | `std::string` | Get header value (with optional default) |
+| `has_header(key)` | `bool` | Check if header exists |
+| `next()` | `bool` | Read next chunk, returns false when done |
+| `data()` | `const char*` | Pointer to current chunk data |
+| `size()` | `size_t` | Size of current chunk |
+| `read_all()` | `std::string` | Read entire remaining body into string |
+| `error()` | `Error` | Get the connection/request error |
+| `read_error()` | `Error` | Get the last read error |
+| `has_read_error()` | `bool` | Check if a read error occurred |
+
+## Usage Examples
+
+### Example 1: SSE (Server-Sent Events) Client
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://localhost:1234");
+    
+    auto result = httplib::stream::Get(cli, "/events");
+    if (!result) { return 1; }
+    
+    while (result.next()) {
+        std::cout.write(result.data(), result.size());
+        std::cout.flush();
+    }
+    
+    return 0;
+}
+```
+
+For a complete SSE client with auto-reconnection and event parsing, see `example/ssecli-stream.cc`.
+
+### Example 2: LLM Streaming Response
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://localhost:11434");  // Ollama
+    
+    auto result = httplib::stream::Get(cli, "/api/generate");
+    
+    if (result && result.status() == 200) {
+        while (result.next()) {
+            std::cout.write(result.data(), result.size());
+            std::cout.flush();
+        }
+    }
+    
+    // Check for connection errors
+    if (result.read_error() != httplib::Error::Success) {
+        std::cerr << "Connection lost\n";
+    }
+    
+    return 0;
+}
+```
+
+### Example 3: Large File Download with Progress
+
+```cpp
+#include "httplib.h"
+#include <fstream>
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://example.com");
+    auto result = httplib::stream::Get(cli, "/large-file.zip");
+    
+    if (!result || result.status() != 200) {
+        std::cerr << "Download failed\n";
+        return 1;
+    }
+    
+    std::ofstream file("download.zip", std::ios::binary);
+    size_t total = 0;
+    
+    while (result.next()) {
+        file.write(result.data(), result.size());
+        total += result.size();
+        std::cout << "\rDownloaded: " << (total / 1024) << " KB" << std::flush;
+    }
+    
+    std::cout << "\nComplete!\n";
+    return 0;
+}
+```
+
+### Example 4: Reverse Proxy Streaming
+
+```cpp
+#include "httplib.h"
+
+httplib::Server svr;
+
+svr.Get("/proxy/(.*)", [](const httplib::Request& req, httplib::Response& res) {
+    httplib::Client upstream("http://backend:8080");
+    auto handle = upstream.open_stream("/" + req.matches[1].str());
+    
+    if (!handle.is_valid()) {
+        res.status = 502;
+        return;
+    }
+    
+    res.status = handle.response->status;
+    res.set_chunked_content_provider(
+        handle.response->get_header_value("Content-Type"),
+        [handle = std::move(handle)](size_t, httplib::DataSink& sink) mutable {
+            char buf[8192];
+            auto n = handle.read(buf, sizeof(buf));
+            if (n > 0) {
+                sink.write(buf, static_cast<size_t>(n));
+                return true;
+            }
+            sink.done();
+            return true;
+        }
+    );
+});
+
+svr.listen("0.0.0.0", 3000);
+```
+
+## Comparison with Existing APIs
+
+| Feature | `Client::Get()` | `open_stream()` | `stream::Get()` |
+|---------|----------------|-----------------|----------------|
+| Headers available | After complete | Immediately | Immediately |
+| Body reading | All at once | Direct from socket | Iterator-based |
+| Memory usage | Full body in RAM | Minimal (controlled) | Minimal (controlled) |
+| Keep-Alive support | ✅ Yes | ❌ No | ❌ No |
+| Compression | Auto-handled | Auto-handled | Auto-handled |
+| Best for | Small responses, Keep-Alive | Low-level streaming | Easy streaming |
+
+## Features
+
+- **True socket-level streaming**: Data is read directly from the network socket
+- **Low memory footprint**: Only the current chunk is held in memory
+- **Compression support**: Automatic decompression for gzip, brotli, and zstd
+- **Chunked transfer**: Full support for chunked transfer encoding
+- **SSL/TLS support**: Works with HTTPS connections
+
+## Important Notes
+
+### Keep-Alive Behavior
+
+The streaming API (`stream::Get()` / `open_stream()`) takes ownership of the socket connection for the duration of the stream. This means:
+
+- **Keep-Alive is not supported** for streaming connections
+- The socket is closed when `StreamHandle` is destroyed
+- For Keep-Alive scenarios, use the standard `client.Get()` API instead
+
+```cpp
+// Use for streaming (no Keep-Alive)
+auto result = httplib::stream::Get(cli, "/large-stream");
+while (result.next()) { /* ... */ }
+
+// Use for Keep-Alive connections
+auto res = cli.Get("/api/data");  // Connection can be reused
+```
+
+## Related
+
+- [Issue #2269](https://github.com/yhirose/cpp-httplib/issues/2269) - Original feature request
+- [example/ssecli-stream.cc](./example/ssecli-stream.cc) - SSE client with auto-reconnection
@@ -0,0 +1,391 @@
+# WebSocket - RFC 6455 WebSocket Support
+
+A simple, blocking WebSocket implementation for C++11.
+
+> [!IMPORTANT]
+> This is a blocking I/O WebSocket implementation using a thread-per-connection model. If you need high-concurrency WebSocket support with non-blocking/async I/O (e.g., thousands of simultaneous connections), this is not the one that you want.
+
+## Features
+
+- **RFC 6455 compliant**: Full WebSocket protocol support
+- **Server and Client**: Both sides included
+- **SSL/TLS support**: `wss://` scheme for secure connections
+- **Text and Binary**: Both message types supported
+- **Automatic heartbeat**: Periodic Ping/Pong keeps connections alive
+- **Subprotocol negotiation**: `Sec-WebSocket-Protocol` support for GraphQL, MQTT, etc.
+
+## Quick Start
+
+### Server
+
+```cpp
+httplib::Server svr;
+
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send("echo: " + msg);
+    }
+});
+
+svr.listen("localhost", 8080);
+```
+
+### Client
+
+```cpp
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+
+if (ws.connect()) {
+    ws.send("hello");
+
+    std::string msg;
+    if (ws.read(msg)) {
+        std::cout << msg << std::endl;  // "echo: hello"
+    }
+    ws.close();
+}
+```
+
+## API Reference
+
+### ReadResult
+
+```cpp
+enum ReadResult : int {
+    Fail   = 0,  // Connection closed or error
+    Text   = 1,  // UTF-8 text message
+    Binary = 2,  // Binary message
+};
+```
+
+Returned by `read()`. Since `Fail` is `0`, the result works naturally in boolean contexts — `while (ws.read(msg))` continues until the connection closes. When you need to distinguish text from binary, check the return value directly.
+
+### CloseStatus
+
+```cpp
+enum class CloseStatus : uint16_t {
+    Normal = 1000,
+    GoingAway = 1001,
+    ProtocolError = 1002,
+    UnsupportedData = 1003,
+    NoStatus = 1005,
+    Abnormal = 1006,
+    InvalidPayload = 1007,
+    PolicyViolation = 1008,
+    MessageTooBig = 1009,
+    MandatoryExtension = 1010,
+    InternalError = 1011,
+};
+```
+
+### Server Registration
+
+```cpp
+// Basic handler
+Server &WebSocket(const std::string &pattern, WebSocketHandler handler);
+
+// With subprotocol negotiation
+Server &WebSocket(const std::string &pattern, WebSocketHandler handler,
+                  SubProtocolSelector sub_protocol_selector);
+```
+
+**Type aliases:**
+
+```cpp
+using WebSocketHandler =
+    std::function<void(const Request &, ws::WebSocket &)>;
+using SubProtocolSelector =
+    std::function<std::string(const std::vector<std::string> &protocols)>;
+```
+
+The `SubProtocolSelector` receives the list of subprotocols proposed by the client (from the `Sec-WebSocket-Protocol` header) and returns the selected one. Return an empty string to decline all proposed subprotocols.
+
+### WebSocket (Server-side)
+
+Passed to the handler registered with `Server::WebSocket()`. The handler runs in a dedicated thread per connection.
+
+```cpp
+// Read next message (blocks until received, returns Fail/Text/Binary)
+ReadResult read(std::string &msg);
+
+// Send messages
+bool send(const std::string &data);              // Text
+bool send(const char *data, size_t len);          // Binary
+
+// Close the connection
+void close(CloseStatus status = CloseStatus::Normal,
+           const std::string &reason = "");
+
+// Access the original HTTP upgrade request
+const Request &request() const;
+
+// Check if the connection is still open
+bool is_open() const;
+```
+
+### WebSocketClient
+
+```cpp
+// Constructor - accepts ws:// or wss:// URL
+explicit WebSocketClient(const std::string &scheme_host_port_path,
+                         const Headers &headers = {});
+
+// Check if the URL was parsed successfully
+bool is_valid() const;
+
+// Connect (performs HTTP upgrade handshake)
+bool connect();
+
+// Get the subprotocol selected by the server (empty if none)
+const std::string &subprotocol() const;
+
+// Read/Send/Close (same as server-side WebSocket)
+ReadResult read(std::string &msg);
+bool send(const std::string &data);
+bool send(const char *data, size_t len);
+void close(CloseStatus status = CloseStatus::Normal,
+           const std::string &reason = "");
+bool is_open() const;
+
+// Timeouts
+void set_read_timeout(time_t sec, time_t usec = 0);
+void set_write_timeout(time_t sec, time_t usec = 0);
+
+// SSL configuration (wss:// only, requires CPPHTTPLIB_OPENSSL_SUPPORT)
+void set_ca_cert_path(const std::string &path);
+void set_ca_cert_store(tls::ca_store_t store);
+void enable_server_certificate_verification(bool enabled);
+```
+
+## Examples
+
+### Echo Server with Connection Logging
+
+```cpp
+httplib::Server svr;
+
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    std::cout << "Connected from " << req.remote_addr << std::endl;
+
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send("echo: " + msg);
+    }
+
+    std::cout << "Disconnected" << std::endl;
+});
+
+svr.listen("localhost", 8080);
+```
+
+### Client: Continuous Read Loop
+
+```cpp
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+
+if (ws.connect()) {
+    ws.send("hello");
+    ws.send("world");
+
+    std::string msg;
+    while (ws.read(msg)) {           // blocks until a message arrives
+        std::cout << msg << std::endl; // "echo: hello", "echo: world"
+    }
+    // read() returns false when the server closes the connection
+}
+```
+
+### Text and Binary Messages
+
+Check the `ReadResult` return value to distinguish between text and binary:
+
+```cpp
+// Server
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    httplib::ws::ReadResult ret;
+    while ((ret = ws.read(msg))) {
+        if (ret == httplib::ws::Text) {
+            ws.send("echo: " + msg);
+        } else {
+            ws.send(msg.data(), msg.size());  // Binary echo
+        }
+    }
+});
+
+// Client
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+if (ws.connect()) {
+    // Send binary data
+    const char binary[] = {0x00, 0x01, 0x02, 0x03};
+    ws.send(binary, sizeof(binary));
+
+    // Receive and check the type
+    std::string msg;
+    if (ws.read(msg) == httplib::ws::Binary) {
+        // Process binary data in msg
+    }
+    ws.close();
+}
+```
+
+### SSL Client
+
+```cpp
+httplib::ws::WebSocketClient ws("wss://echo.example.com/ws");
+
+if (ws.connect()) {
+    ws.send("hello over TLS");
+
+    std::string msg;
+    if (ws.read(msg)) {
+        std::cout << msg << std::endl;
+    }
+    ws.close();
+}
+```
+
+### Close with Status
+
+```cpp
+// Client-side: close with a specific status code and reason
+ws.close(httplib::ws::CloseStatus::GoingAway, "shutting down");
+
+// Server-side: close with a policy violation status
+ws.close(httplib::ws::CloseStatus::PolicyViolation, "forbidden");
+```
+
+### Accessing the Upgrade Request
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    // Access headers from the original HTTP upgrade request
+    auto auth = req.get_header_value("Authorization");
+    if (auth.empty()) {
+        ws.close(httplib::ws::CloseStatus::PolicyViolation, "unauthorized");
+        return;
+    }
+
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send("echo: " + msg);
+    }
+});
+```
+
+### Custom Headers and Timeouts
+
+```cpp
+httplib::Headers headers = {
+    {"Authorization", "Bearer token123"}
+};
+
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws", headers);
+ws.set_read_timeout(30, 0);   // 30 seconds
+ws.set_write_timeout(10, 0);  // 10 seconds
+
+if (ws.connect()) {
+    std::string msg;
+    while (ws.read(msg)) {
+        std::cout << msg << std::endl;
+    }
+}
+```
+
+### Subprotocol Negotiation
+
+The server can negotiate a subprotocol with the client using `Sec-WebSocket-Protocol`. This is required for protocols like GraphQL over WebSocket (`graphql-ws`) and MQTT.
+
+```cpp
+// Server: register a handler with a subprotocol selector
+svr.WebSocket(
+    "/ws",
+    [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+        std::string msg;
+        while (ws.read(msg)) {
+            ws.send("echo: " + msg);
+        }
+    },
+    [](const std::vector<std::string> &protocols) -> std::string {
+        // The client proposed a list of subprotocols; pick one
+        for (const auto &p : protocols) {
+            if (p == "graphql-ws" || p == "graphql-transport-ws") {
+                return p;
+            }
+        }
+        return "";  // Decline all
+    });
+
+// Client: propose subprotocols via Sec-WebSocket-Protocol header
+httplib::Headers headers = {
+    {"Sec-WebSocket-Protocol", "graphql-ws, graphql-transport-ws"}
+};
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws", headers);
+
+if (ws.connect()) {
+    // Check which subprotocol the server selected
+    std::cout << "Subprotocol: " << ws.subprotocol() << std::endl;
+    // => "graphql-ws"
+    ws.close();
+}
+```
+
+### SSL Client with Certificate Configuration
+
+```cpp
+httplib::ws::WebSocketClient ws("wss://example.com/ws");
+ws.set_ca_cert_path("/path/to/ca-bundle.crt");
+ws.enable_server_certificate_verification(true);
+
+if (ws.connect()) {
+    ws.send("secure message");
+    ws.close();
+}
+```
+
+## Configuration
+
+| Macro                                       | Default           | Description                                              |
+|---------------------------------------------|-------------------|----------------------------------------------------------|
+| `CPPHTTPLIB_WEBSOCKET_MAX_PAYLOAD_LENGTH`   | `16777216` (16MB) | Maximum payload size per message                         |
+| `CPPHTTPLIB_WEBSOCKET_READ_TIMEOUT_SECOND`  | `300`             | Read timeout for WebSocket connections (seconds)         |
+| `CPPHTTPLIB_WEBSOCKET_CLOSE_TIMEOUT_SECOND` | `5`               | Timeout for waiting peer's Close response (seconds)      |
+| `CPPHTTPLIB_WEBSOCKET_PING_INTERVAL_SECOND` | `30`              | Automatic Ping interval for heartbeat (seconds)          |
+
+## Threading Model
+
+WebSocket connections share the same thread pool as HTTP requests. Each WebSocket connection occupies one thread for its entire lifetime.
+
+The default thread pool uses dynamic scaling: it maintains a base thread count of `CPPHTTPLIB_THREAD_POOL_COUNT` (8 or `std::thread::hardware_concurrency() - 1`, whichever is greater) and can scale up to 4x that count under load (`CPPHTTPLIB_THREAD_POOL_MAX_COUNT`). When all base threads are busy, temporary threads are spawned automatically up to the maximum. These dynamic threads exit after an idle timeout (`CPPHTTPLIB_THREAD_POOL_IDLE_TIMEOUT`, default 3 seconds).
+
+This dynamic scaling helps accommodate WebSocket connections alongside HTTP requests. However, if you expect many simultaneous WebSocket connections, you should configure the thread pool accordingly:
+
+```cpp
+httplib::Server svr;
+
+svr.new_task_queue = [] {
+  return new httplib::ThreadPool(/*base_threads=*/8, /*max_threads=*/128);
+};
+```
+
+Choose sizes that account for both your expected HTTP load and the maximum number of simultaneous WebSocket connections.
+
+## Protocol
+
+The implementation follows [RFC 6455](https://tools.ietf.org/html/rfc6455):
+
+- Handshake via HTTP Upgrade with `Sec-WebSocket-Key` / `Sec-WebSocket-Accept`
+- Subprotocol negotiation via `Sec-WebSocket-Protocol`
+- Frame masking (client-to-server)
+- Control frames: Close, Ping, Pong
+- Message fragmentation and reassembly
+- Close handshake with status codes
+
+## Browser Test
+
+Run the echo server example and open `http://localhost:8080` in a browser:
+
+```bash
+cd example && make wsecho && ./wsecho
+```
@@ -1,5 +1,4 @@
-cpp-httplib
-===========
+# cpp-httplib

 [![](https://github.com/yhirose/cpp-httplib/workflows/test/badge.svg)](https://github.com/yhirose/cpp-httplib/actions)

@@ -10,10 +9,17 @@ It's extremely easy to set up. Just include the **httplib.h** file in your code!
 > [!IMPORTANT]
 > This library uses 'blocking' socket I/O. If you are looking for a library with 'non-blocking' socket I/O, this is not the one that you want.

-Simple examples
---------------
+## Main Features

-#### Server (Multi-threaded)
+- HTTP Server/Client
+- SSL/TLS support (OpenSSL, MbedTLS, wolfSSL)
+- [Stream API](README-stream.md)
+- [Server-Sent Events](README-sse.md)
+- [WebSocket](README-websocket.md)
+
+## Simple examples
+
+### Server

 ```c++
 #define CPPHTTPLIB_OPENSSL_SUPPORT
@@ -32,7 +38,7 @@ svr.Get("/hi", [](const httplib::Request &, httplib::Response &res) {
 svr.listen("0.0.0.0", 8080);
 ```

-#### Client
+### Client

 ```c++
 #define CPPHTTPLIB_OPENSSL_SUPPORT
@@ -44,24 +50,40 @@ httplib::Client cli("http://yhirose.github.io");
 // HTTPS
 httplib::Client cli("https://yhirose.github.io");

-auto res = cli.Get("/hi");
-res->status;
-res->body;
+if (auto res = cli.Get("/hi")) {
+  res->status;
+  res->body;
+}
 ```

-SSL Support
-----------
+## SSL/TLS Support

-SSL support is available with `CPPHTTPLIB_OPENSSL_SUPPORT`. `libssl` and `libcrypto` should be linked.
+cpp-httplib supports multiple TLS backends through an abstraction layer:
+
+| Backend | Define | Libraries |
+| :------ | :----- | :-------- |
+| OpenSSL | `CPPHTTPLIB_OPENSSL_SUPPORT` | `libssl`, `libcrypto` |
+| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` |
+| wolfSSL | `CPPHTTPLIB_WOLFSSL_SUPPORT` | `libwolfssl` |

 > [!NOTE]
-> cpp-httplib currently supports only version 3.0 or later. Please see [this page](https://www.openssl.org/policies/releasestrat.html) to get more information.
+> OpenSSL 3.0 or later is required. Please see [this page](https://www.openssl.org/policies/releasestrat.html) for more information.
+
+> [!NOTE]
+> Mbed TLS 2.x and 3.x are supported. The library automatically detects the version and uses the appropriate API.
+
+> [!NOTE]
+> wolfSSL must be built with OpenSSL compatibility layer enabled (`--enable-opensslall`). wolfSSL 5.x is supported.
+
+> [!NOTE]
+> **Mbed TLS / wolfSSL limitation:** `get_ca_certs()` and `get_ca_names()` only reflect CA certificates loaded via `load_ca_cert_store()` or `load_ca_cert_store(pem, size)`. Certificates loaded through `set_ca_cert_path()` or system certificates (`load_system_certs`) are not enumerable with these backends.

 > [!TIP]
-> For macOS: cpp-httplib now can use system certs with `CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN`. `CoreFoundation` and `Security` should be linked with `-framework`.
+> For macOS: cpp-httplib can use system certs with `CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN`. `CoreFoundation` and `Security` should be linked with `-framework`.

 ```c++
-#define CPPHTTPLIB_OPENSSL_SUPPORT
+// Use either OpenSSL, Mbed TLS, or wolfSSL
+#define CPPHTTPLIB_OPENSSL_SUPPORT   // or CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT
 #include "path/to/httplib.h"

 // Server
@@ -82,15 +104,15 @@ cli.enable_server_certificate_verification(false);
 cli.enable_server_hostname_verification(false);
 ```

-> [!NOTE]
-> When using SSL, it seems impossible to avoid SIGPIPE in all cases, since on some operating systems, SIGPIPE can only be suppressed on a per-message basis, but there is no way to make the OpenSSL library do so for its internal communications. If your program needs to avoid being terminated on SIGPIPE, the only fully general way might be to set up a signal handler for SIGPIPE to handle or ignore it yourself.
-
 ### SSL Error Handling

-When SSL operations fail, cpp-httplib provides detailed error information through two separate error fields:
+When SSL operations fail, cpp-httplib provides detailed error information through `ssl_error()` and `ssl_backend_error()`:
+
+- `ssl_error()` - Returns the TLS-level error code (e.g., `SSL_ERROR_SSL` for OpenSSL)
+- `ssl_backend_error()` - Returns the backend-specific error code (e.g., `ERR_get_error()` for OpenSSL/wolfSSL, return value for Mbed TLS)

 ```c++
-#define CPPHTTPLIB_OPENSSL_SUPPORT
+#define CPPHTTPLIB_OPENSSL_SUPPORT  // or CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT
 #include "path/to/httplib.h"

 httplib::Client cli("https://example.com");
@@ -98,38 +120,104 @@ httplib::Client cli("https://example.com");
 auto res = cli.Get("/");
 if (!res) {
  // Check the error type
-  auto err = res.error();
+  const auto err = res.error();

  switch (err) {
    case httplib::Error::SSLConnection:
      std::cout << "SSL connection failed, SSL error: "
-                << res->ssl_error() << std::endl;
+                << res.ssl_error() << std::endl;
      break;

    case httplib::Error::SSLLoadingCerts:
-      std::cout << "SSL cert loading failed, OpenSSL error: "
-                << std::hex << res->ssl_openssl_error() << std::endl;
+      std::cout << "SSL cert loading failed, backend error: "
+                << std::hex << res.ssl_backend_error() << std::endl;
      break;

    case httplib::Error::SSLServerVerification:
-      std::cout << "SSL verification failed, X509 error: "
-                << res->ssl_openssl_error() << std::endl;
+      std::cout << "SSL verification failed, verify error: "
+                << res.ssl_backend_error() << std::endl;
      break;

    case httplib::Error::SSLServerHostnameVerification:
-      std::cout << "SSL hostname verification failed, X509 error: "
-                << res->ssl_openssl_error() << std::endl;
+      std::cout << "SSL hostname verification failed, verify error: "
+                << res.ssl_backend_error() << std::endl;
      break;

    default:
      std::cout << "HTTP error: " << httplib::to_string(err) << std::endl;
-    }
  }
 }
 ```

-Server
------
+### Custom Certificate Verification
+
+You can set a custom verification callback using `tls::VerifyCallback`:
+
+```c++
+httplib::Client cli("https://example.com");
+
+cli.set_server_certificate_verifier(
+    [](const httplib::tls::VerifyContext &ctx) -> bool {
+      std::cout << "Subject CN: " << ctx.subject_cn() << std::endl;
+      std::cout << "Issuer: " << ctx.issuer_name() << std::endl;
+      std::cout << "Depth: " << ctx.depth << std::endl;
+      std::cout << "Pre-verified: " << ctx.preverify_ok << std::endl;
+
+      // Inspect SANs (Subject Alternative Names)
+      for (const auto &san : ctx.sans()) {
+        std::cout << "SAN: " << san.value << std::endl;
+      }
+
+      // Return true to accept, false to reject
+      return ctx.preverify_ok;
+    });
+```
+
+### Peer Certificate Inspection
+
+On the server side, you can inspect the client's peer certificate from a request handler:
+
+```c++
+httplib::SSLServer svr("./cert.pem", "./key.pem",
+                       "./client-ca-cert.pem");
+
+svr.Get("/", [](const httplib::Request &req, httplib::Response &res) {
+  auto cert = req.peer_cert();
+  if (cert) {
+    std::cout << "Client CN: " << cert.subject_cn() << std::endl;
+    std::cout << "Serial: " << cert.serial() << std::endl;
+  }
+
+  auto sni = req.sni();
+  std::cout << "SNI: " << sni << std::endl;
+});
+```
+
+### Windows Certificate Verification
+
+On Windows, cpp-httplib automatically performs additional certificate verification using the Windows certificate store via CryptoAPI (`CertGetCertificateChain` / `CertVerifyCertificateChainPolicy`). This works with all TLS backends (OpenSSL, Mbed TLS, and wolfSSL), providing:
+
+- Real-time certificate validation integrated with Windows Update
+- Certificate revocation checking
+- SSL/TLS policy verification using the system certificate store (ROOT and CA)
+
+This feature is enabled by default and can be controlled at runtime:
+
+```c++
+// Disable Windows certificate verification (use only OpenSSL/Mbed TLS/wolfSSL verification)
+cli.enable_windows_certificate_verification(false);
+```
+
+To disable this feature at compile time, define:
+
+```c++
+#define CPPHTTPLIB_DISABLE_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE
+```
+
+> [!NOTE]
+> When using SSL, it seems impossible to avoid SIGPIPE in all cases, since on some operating systems, SIGPIPE can only be suppressed on a per-message basis, but there is no way to make the OpenSSL library do so for its internal communications. If your program needs to avoid being terminated on SIGPIPE, the only fully general way might be to set up a signal handler for SIGPIPE to handle or ignore it yourself.
+
+## Server

 ```c++
 #include <httplib.h>
@@ -191,7 +279,7 @@ int main(void)
 }
 ```

-`Post`, `Put`, `Delete` and `Options` methods are also supported.
+`Post`, `Put`, `Patch`, `Delete` and `Options` methods are also supported.

 ### Bind a socket to multiple interfaces and any available port

@@ -269,23 +357,47 @@ svr.set_file_request_handler([](const Request &req, Response &res) {

 ### Logging

+cpp-httplib provides separate logging capabilities for access logs and error logs, similar to web servers like Nginx and Apache.
+
+#### Access Logging
+
+Access loggers capture successful HTTP requests and responses:
+
 ```cpp
-svr.set_logger([](const auto& req, const auto& res) {
-  your_logger(req, res);
+svr.set_logger([](const httplib::Request& req, const httplib::Response& res) {
+  std::cout << req.method << " " << req.path << " -> " << res.status << std::endl;
 });
 ```

-You can also set a pre-compression logger to capture request/response data before compression is applied. This is useful for debugging and monitoring purposes when you need to see the original, uncompressed response content:
+#### Pre-compression Logging
+
+You can also set a pre-compression logger to capture request/response data before compression is applied:

 ```cpp
-svr.set_pre_compression_logger([](const auto& req, const auto& res) {
+svr.set_pre_compression_logger([](const httplib::Request& req, const httplib::Response& res) {
  // Log before compression - res.body contains uncompressed content
  // Content-Encoding header is not yet set
  your_pre_compression_logger(req, res);
 });
 ```

-The pre-compression logger is only called when compression would be applied. For responses without compression, only the regular logger is called.
+The pre-compression logger is only called when compression would be applied. For responses without compression, only the access logger is called.
+
+#### Error Logging
+
+Error loggers capture failed requests and connection issues. Unlike access loggers, error loggers only receive the Error and Request information, as errors typically occur before a meaningful Response can be generated.
+
+```cpp
+svr.set_error_logger([](const httplib::Error& err, const httplib::Request* req) {
+  std::cerr << httplib::to_string(err) << " while processing request";
+  if (req) {
+    std::cerr << ", client: " << req->get_header_value("X-Forwarded-For")
+              << ", request: '" << req->method << " " << req->path << " " << req->version << "'"
+              << ", host: " << req->get_header_value("Host");
+  }
+  std::cerr << std::endl;
+});
+```

 ### Error handler

@@ -356,6 +468,34 @@ svr.set_pre_request_handler([](const auto& req, auto& res) {
 });
 ```

+### Response user data
+
+`res.user_data` is a `std::map<std::string, httplib::any>` that lets pre-routing or pre-request handlers pass arbitrary data to route handlers.
+
+```cpp
+struct AuthContext {
+  std::string user_id;
+  std::string role;
+};
+
+svr.set_pre_routing_handler([](const auto& req, auto& res) {
+  auto token = req.get_header_value("Authorization");
+  res.user_data["auth"] = AuthContext{decode_token(token)};
+  return Server::HandlerResponse::Unhandled;
+});
+
+svr.Get("/me", [](const auto& /*req*/, auto& res) {
+  auto* ctx = httplib::any_cast<AuthContext>(&res.user_data["auth"]);
+  if (!ctx) {
+    res.status = StatusCode::Unauthorized_401;
+    return;
+  }
+  res.set_content("Hello " + ctx->user_id, "text/plain");
+});
+```
+
+`httplib::any` mirrors the C++17 `std::any` API. On C++17 and later it is an alias for `std::any`; on C++11/14 a compatible implementation is provided.
+
 ### Form data handling

 #### URL-encoded form data ('application/x-www-form-urlencoded')
@@ -610,20 +750,24 @@ Please see [Server example](https://github.com/yhirose/cpp-httplib/blob/master/e

 ### Default thread pool support

-`ThreadPool` is used as the **default** task queue, with a default thread count of 8 or `std::thread::hardware_concurrency() - 1`, whichever is greater. You can change it with `CPPHTTPLIB_THREAD_POOL_COUNT`.
+`ThreadPool` is used as the **default** task queue, with dynamic scaling support. By default, it maintains a base thread count of 8 or `std::thread::hardware_concurrency() - 1` (whichever is greater), and can scale up to 4x that count under load. You can change these with `CPPHTTPLIB_THREAD_POOL_COUNT` and `CPPHTTPLIB_THREAD_POOL_MAX_COUNT`.

-If you want to set the thread count at runtime, there is no convenient way... But here is how.
+When all threads are busy and a new task arrives, a temporary thread is spawned (up to the maximum). When a dynamic thread finishes its task and the queue is empty, or after an idle timeout, it exits automatically. The idle timeout defaults to 3 seconds, configurable via `CPPHTTPLIB_THREAD_POOL_IDLE_TIMEOUT`.
+
+If you want to set the thread counts at runtime:

 ```cpp
-svr.new_task_queue = [] { return new ThreadPool(12); };
+svr.new_task_queue = [] { return new ThreadPool(/*base_threads=*/8, /*max_threads=*/64); };
 ```

+#### Max queued requests
+
 You can also provide an optional parameter to limit the maximum number
 of pending requests, i.e. requests `accept()`ed by the listener but
 still waiting to be serviced by worker threads.

 ```cpp
-svr.new_task_queue = [] { return new ThreadPool(/*num_threads=*/12, /*max_queued_requests=*/18); };
+svr.new_task_queue = [] { return new ThreadPool(/*base_threads=*/12, /*max_threads=*/0, /*max_queued_requests=*/18); };
 ```

 Default limit is 0 (unlimited). Once the limit is reached, the listener
@@ -659,8 +803,7 @@ svr.new_task_queue = [] {
 };
 ```

-Client
------
+## Client

 ```c++
 #include <httplib.h>
@@ -698,7 +841,7 @@ httplib::SSLClient cli("localhost");
 Here is the list of errors from `Result::error()`.

 ```c++
-enum Error {
+enum class Error {
  Success = 0,
  Unknown,
  Connection,
@@ -715,9 +858,72 @@ enum Error {
  Compression,
  ConnectionTimeout,
  ProxyConnection,
+  ConnectionClosed,
+  Timeout,
+  ResourceExhaustion,
+  TooManyFormDataFiles,
+  ExceedMaxPayloadSize,
+  ExceedUriMaxLength,
+  ExceedMaxSocketDescriptorCount,
+  InvalidRequestLine,
+  InvalidHTTPMethod,
+  InvalidHTTPVersion,
+  InvalidHeaders,
+  MultipartParsing,
+  OpenFile,
+  Listen,
+  GetSockName,
+  UnsupportedAddressFamily,
+  HTTPParsing,
+  InvalidRangeHeader,
 };
 ```

+### Client Logging
+
+#### Access Logging
+
+```cpp
+cli.set_logger([](const httplib::Request& req, const httplib::Response& res) {
+  auto duration = std::chrono::duration_cast<std::chrono::milliseconds>(
+    std::chrono::steady_clock::now() - start_time).count();
+  std::cout << "✓ " << req.method << " " << req.path
+            << " -> " << res.status << " (" << res.body.size() << " bytes, "
+            << duration << "ms)" << std::endl;
+});
+```
+
+#### Error Logging
+
+```cpp
+cli.set_error_logger([](const httplib::Error& err, const httplib::Request* req) {
+  std::cerr << "✗ ";
+  if (req) {
+    std::cerr << req->method << " " << req->path << " ";
+  }
+  std::cerr << "failed: " << httplib::to_string(err);
+
+  // Add specific guidance based on error type
+  switch (err) {
+    case httplib::Error::Connection:
+      std::cerr << " (verify server is running and reachable)";
+      break;
+    case httplib::Error::SSLConnection:
+      std::cerr << " (check SSL certificate and TLS configuration)";
+      break;
+    case httplib::Error::ConnectionTimeout:
+      std::cerr << " (increase timeout or check network latency)";
+      break;
+    case httplib::Error::Read:
+      std::cerr << " (server may have closed connection prematurely)";
+      break;
+    default:
+      break;
+  }
+  std::cerr << std::endl;
+});
+```
+
 ### GET with HTTP headers

 ```c++
@@ -726,11 +932,15 @@ httplib::Headers headers = {
 };
 auto res = cli.Get("/hi", headers);
 ```
+
 or
+
 ```c++
 auto res = cli.Get("/hi", {{"Hello", "World!"}});
 ```
+
 or
+
 ```c++
 cli.set_default_headers({
  { "Hello", "World!" }
@@ -779,12 +989,29 @@ httplib::UploadFormDataItems items = {
 auto res = cli.Post("/multipart", items);
 ```

+To upload files from disk without loading them entirely into memory, use `make_file_provider`. The file is read and sent in chunks with a correct `Content-Length` header.
+
+```cpp
+httplib::FormDataProviderItems providers = {
+  httplib::make_file_provider("file1", "/path/to/large.bin", "large.bin", "application/octet-stream"),
+  httplib::make_file_provider("avatar", "/path/to/photo.jpg", "photo.jpg", "image/jpeg"),
+};
+
+auto res = cli.Post("/upload", {}, {}, providers);
+```
+
 ### PUT

 ```c++
 res = cli.Put("/resource/foo", "text", "text/plain");
 ```

+### PATCH
+
+```c++
+res = cli.Patch("/resource/foo", "text", "text/plain");
+```
+
 ### DELETE

 ```c++
@@ -809,6 +1036,12 @@ cli.set_write_timeout(5, 0); // 5 seconds
 cli.set_max_timeout(5000); // 5 seconds
 ```

+### Set maximum payload length for reading a response body
+
+```c++
+cli.set_payload_max_length(1024 * 1024 * 512); // 512MB
+```
+
 ### Receive content with a content receiver

 ```c++
@@ -871,7 +1104,7 @@ auto res = cli.Post(
 httplib::Client cli(url, port);

 // prints: 0 / 000 bytes => 50% complete
-auto res = cli.Get("/", [](uint64_t len, uint64_t total) {
+auto res = cli.Get("/", [](size_t len, size_t total) {
  printf("%lld / %lld bytes => %d%% complete\n",
    len, total,
    (int)(len*100/total));
@@ -919,7 +1152,7 @@ cli.set_proxy_bearer_token_auth("pass");
 ### Range

 ```cpp
-httplib::Client cli("httpbin.org");
+httplib::Client cli("httpcan.org");

 auto res = cli.Get("/range/32", {
  httplib::make_range_header({{1, 10}}) // 'Range: bytes=1-10'
@@ -990,18 +1223,40 @@ auto res = cli.Get("/already%20encoded/path"); // Use pre-encoded paths
  - `true` (default): Automatically encodes spaces, plus signs, newlines, and other special characters
  - `false`: Sends paths as-is without encoding (useful for pre-encoded URLs)

-Compression
-----------
+### Performance Note for Local Connections
+
+> [!WARNING]
+> On Windows systems with improperly configured IPv6 settings, using "localhost" as the hostname may cause significant connection delays (up to 2 seconds per request) due to DNS resolution issues. This affects both client and server operations. For better performance when connecting to local services, use "127.0.0.1" instead of "localhost".
+> 
+> See: https://github.com/yhirose/cpp-httplib/issues/366#issuecomment-593004264
+
+```cpp
+// May be slower on Windows due to DNS resolution delays
+httplib::Client cli("localhost", 8080);
+httplib::Server svr;
+svr.listen("localhost", 8080);
+
+// Faster alternative for local connections
+httplib::Client cli("127.0.0.1", 8080);
+httplib::Server svr;
+svr.listen("127.0.0.1", 8080);
+```
+
+## Payload Limit
+
+The maximum payload body size is limited to 100MB by default for both server and client. You can change it with `set_payload_max_length()` or by defining `CPPHTTPLIB_PAYLOAD_MAX_LENGTH` at compile time. Setting it to `0` disables the limit entirely.
+
+## Compression

 The server can apply compression to the following MIME type contents:

-  * all text types except text/event-stream
-  * image/svg+xml
-  * application/javascript
-  * application/json
-  * application/xml
-  * application/protobuf
-  * application/xhtml+xml
+- all text types except text/event-stream
+- image/svg+xml
+- application/javascript
+- application/json
+- application/xml
+- application/protobuf
+- application/xhtml+xml

 ### Zlib Support

@@ -1065,6 +1320,8 @@ cli.set_address_family(AF_UNIX);

 "my-socket.sock" can be a relative path or an absolute path. Your application must have the appropriate permissions for the path. You can also use an abstract socket address on Linux. To use an abstract socket address, prepend a null byte ('\x00') to the path.

+This library automatically sets the Host header to "localhost" for Unix socket connections, similar to curl's behavior:
+

 URI Encoding/Decoding Utilities
 -------------------------------
@@ -1092,9 +1349,95 @@ std::string decoded_component = httplib::decode_uri_component(encoded_component)

 Use `encode_uri()` for full URLs and `encode_uri_component()` for individual query parameters or path segments.

+## Stream API

-Split httplib.h into .h and .cc
-------------------------------
+Process large responses without loading everything into memory.
+
+```c++
+httplib::Client cli("localhost", 8080);
+cli.set_follow_location(true);
+...
+
+auto result = httplib::stream::Get(cli, "/large-file");
+if (result) {
+  while (result.next()) {
+    process(result.data(), result.size());  // Process each chunk as it arrives
+  }
+}
+
+// Or read the entire body at once
+auto result2 = httplib::stream::Get(cli, "/file");
+if (result2) {
+  std::string body = result2.read_all();
+}
+```
+
+All HTTP methods are supported: `stream::Get`, `Post`, `Put`, `Patch`, `Delete`, `Head`, `Options`.
+
+See [README-stream.md](README-stream.md) for more details.
+
+## SSE Client
+
+```cpp
+#include <httplib.h>
+
+int main() {
+    httplib::Client cli("http://localhost:8080");
+    httplib::sse::SSEClient sse(cli, "/events");
+
+    sse.on_message([](const httplib::sse::SSEMessage &msg) {
+        std::cout << "Event: " << msg.event << std::endl;
+        std::cout << "Data: " << msg.data << std::endl;
+    });
+
+    sse.start();  // Blocking, with auto-reconnect
+    return 0;
+}
+```
+
+See [README-sse.md](README-sse.md) for more details.
+
+## WebSocket
+
+```cpp
+// Server
+httplib::Server svr;
+
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    httplib::ws::Message msg;
+    while (ws.read(msg)) {
+        if (msg.is_text()) {
+            ws.send("Echo: " + msg.data);
+        }
+    }
+});
+
+svr.listen("localhost", 8080);
+```
+
+```cpp
+// Client
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+
+if (ws.connect()) {
+    ws.send("Hello, WebSocket!");
+
+    std::string msg;
+    if (ws.read(msg)) {
+        std::cout << "Received: " << msg << std::endl;
+    }
+
+    ws.close();
+}
+```
+
+SSL is also supported via `wss://` scheme (e.g. `WebSocketClient("wss://example.com/ws")`). Subprotocol negotiation (`Sec-WebSocket-Protocol`) is supported via `SubProtocolSelector` callback.
+
+> **Note:** WebSocket connections occupy a thread for their entire lifetime. If you plan to handle many simultaneous WebSocket connections, consider using a dynamic thread pool: `svr.new_task_queue = [] { return new ThreadPool(8, 64); };`
+
+See [README-websocket.md](README-websocket.md) for more details.
+
+## Split httplib.h into .h and .cc

 ```console
 $ ./split.py -h
@@ -1112,8 +1455,7 @@ $ ./split.py
 Wrote out/httplib.h and out/httplib.cc
 ```

-Dockerfile for Static HTTP Server
---------------------------------
+## Dockerfile for Static HTTP Server

 Dockerfile for static HTTP server is available. Port number of this HTTP server is 80, and it serves static files from `/html` directory in the container.

@@ -1141,6 +1483,24 @@ Serving HTTP on 0.0.0.0 port 80 ...
 NOTE
 ----

+### Regular Expression Stack Overflow
+
+> [!CAUTION]
+> When using complex regex patterns in route handlers, be aware that certain patterns may cause stack overflow during pattern matching. This is a known issue with `std::regex` implementations and affects the `dispatch_request()` method.
+> 
+> ```cpp
+> // This pattern can cause stack overflow with large input
+> svr.Get(".*", handler);
+> ```
+> 
+> Consider using simpler patterns or path parameters to avoid this issue:
+> 
+> ```cpp
+> // Safer alternatives
+> svr.Get("/users/:id", handler);           // Path parameters
+> svr.Get(R"(/api/v\d+/.*)", handler);     // More specific patterns
+> ```
+
 ### g++

 g++ 4.8 and below cannot build this library since `<regex>` in the versions are [broken](https://stackoverflow.com/questions/12530406/is-gcc-4-8-or-earlier-buggy-about-regular-expressions).
@@ -1166,12 +1526,10 @@ Include `httplib.h` before `Windows.h` or include `Windows.h` by defining `WIN32
 > [!NOTE]
 > Windows 8 or lower, Visual Studio 2015 or lower, and Cygwin and MSYS2 including MinGW are neither supported nor tested.

-License
-------
+## License

-MIT license (© 2025 Yuji Hirose)
+MIT license (© 2026 Yuji Hirose)

-Special Thanks To
-----------------
+## Special Thanks To

 [These folks](https://github.com/yhirose/cpp-httplib/graphs/contributors) made great contributions to polish this library to totally another level from a simple toy!
@@ -86,7 +86,9 @@ foreach(_listvar "common;common" "decoder;dec" "encoder;enc")
 	# Check if the target was already found by Pkgconf
 	if(TARGET PkgConfig::Brotli_${_component_name}${_brotli_stat_str})
 		# ALIAS since we don't want the PkgConfig namespace on the Cmake library (for end-users)
-		add_library(Brotli::${_component_name} ALIAS PkgConfig::Brotli_${_component_name}${_brotli_stat_str})
+		if (NOT TARGET Brotli::${_component_name})
+			add_library(Brotli::${_component_name} ALIAS PkgConfig::Brotli_${_component_name}${_brotli_stat_str})
+		endif()

 		# Tells HANDLE_COMPONENTS we found the component
 		set(Brotli_${_component_name}_FOUND TRUE)
@@ -139,7 +141,10 @@ foreach(_listvar "common;common" "decoder;dec" "encoder;enc")
 		# Tells HANDLE_COMPONENTS we found the component
 		set(Brotli_${_component_name}_FOUND TRUE)

-		add_library("Brotli::${_component_name}" UNKNOWN IMPORTED)
+		if (NOT TARGET Brotli::${_component_name})
+			add_library("Brotli::${_component_name}" UNKNOWN IMPORTED)
+		endif()
+		
 		# Attach the literal library and include dir to the IMPORTED target for the end-user
 		set_target_properties("Brotli::${_component_name}" PROPERTIES
 			INTERFACE_INCLUDE_DIRECTORIES "${Brotli_INCLUDE_DIR}"
@@ -0,0 +1,16 @@
+# This file contains C++20 module support requiring CMake 3.28+
+# Included conditionally to prevent parse errors on older CMake versions
+
+if(HTTPLIB_BUILD_MODULES)
+	if(POLICY CMP0155)
+		cmake_policy(SET CMP0155 NEW)
+	endif()
+
+	set(CMAKE_CXX_SCAN_FOR_MODULES ON)
+	
+	target_sources(${PROJECT_NAME}
+		PUBLIC
+			FILE_SET CXX_MODULES FILES
+				"${_httplib_build_includedir}/httplib.cppm"
+	)
+endif()
@@ -1,81 +1,303 @@
 //
 //  main.cc
 //
-//  Copyright (c) 2025 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

+#include <atomic>
 #include <chrono>
 #include <ctime>
 #include <format>
 #include <iomanip>
 #include <iostream>
+#include <signal.h>
 #include <sstream>

 #include <httplib.h>

-constexpr auto error_html = R"(<html>
-<head><title>{} {}</title></head>
-<body>
-<center><h1>404 Not Found</h1></center>
-<hr><center>cpp-httplib/{}</center>
-</body>
-</html>
-)";
+using namespace httplib;

-void sigint_handler(int s) { exit(1); }
+const auto SERVER_NAME =
+    std::format("cpp-httplib-server/{}", CPPHTTPLIB_VERSION);

-std::string time_local() {
-  auto p = std::chrono::system_clock::now();
-  auto t = std::chrono::system_clock::to_time_t(p);
+Server svr;
+
+void signal_handler(int signal) {
+  if (signal == SIGINT || signal == SIGTERM) {
+    std::cout << "\nReceived signal, shutting down gracefully...\n";
+    svr.stop();
+  }
+}
+
+std::string get_time_format() {
+  auto now = std::chrono::system_clock::now();
+  auto time_t = std::chrono::system_clock::to_time_t(now);

  std::stringstream ss;
-  ss << std::put_time(std::localtime(&t), "%d/%b/%Y:%H:%M:%S %z");
+  ss << std::put_time(std::localtime(&time_t), "%d/%b/%Y:%H:%M:%S %z");
  return ss.str();
 }

-std::string log(auto &req, auto &res) {
-  auto remote_user = "-"; // TODO:
-  auto request = std::format("{} {} {}", req.method, req.path, req.version);
-  auto body_bytes_sent = res.get_header_value("Content-Length");
-  auto http_referer = "-"; // TODO:
-  auto http_user_agent = req.get_header_value("User-Agent", "-");
+std::string get_error_time_format() {
+  auto now = std::chrono::system_clock::now();
+  auto time_t = std::chrono::system_clock::to_time_t(now);

-  // NOTE: From NGINX default access log format
-  // log_format combined '$remote_addr - $remote_user [$time_local] '
-  //                     '"$request" $status $body_bytes_sent '
-  //                     '"$http_referer" "$http_user_agent"';
-  return std::format(R"({} - {} [{}] "{}" {} {} "{}" "{}")", req.remote_addr,
-                     remote_user, time_local(), request, res.status,
-                     body_bytes_sent, http_referer, http_user_agent);
+  std::stringstream ss;
+  ss << std::put_time(std::localtime(&time_t), "%Y/%m/%d %H:%M:%S");
+  return ss.str();
 }

-int main(int argc, const char **argv) {
-  signal(SIGINT, sigint_handler);
+// NGINX Combined log format:
+// $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent
+// "$http_referer" "$http_user_agent"
+void nginx_access_logger(const Request &req, const Response &res) {
+  std::string remote_user =
+      "-"; // cpp-httplib doesn't have built-in auth user tracking
+  auto time_local = get_time_format();
+  auto request = std::format("{} {} {}", req.method, req.path, req.version);
+  auto status = res.status;
+  auto body_bytes_sent = res.body.size();
+  auto http_referer = req.get_header_value("Referer");
+  if (http_referer.empty()) http_referer = "-";
+  auto http_user_agent = req.get_header_value("User-Agent");
+  if (http_user_agent.empty()) http_user_agent = "-";

-  auto base_dir = "./html";
-  auto host = "0.0.0.0";
-  auto port = 80;
+  std::cout << std::format("{} - {} [{}] \"{}\" {} {} \"{}\" \"{}\"",
+                           req.remote_addr, remote_user, time_local, request,
+                           status, body_bytes_sent, http_referer,
+                           http_user_agent)
+            << std::endl;
+}

-  httplib::Server svr;
+// NGINX Error log format:
+// YYYY/MM/DD HH:MM:SS [level] message, client: client_ip, request: "request",
+// host: "host"
+void nginx_error_logger(const Error &err, const Request *req) {
+  auto time_local = get_error_time_format();
+  std::string level = "error";

-  svr.set_error_handler([](auto & /*req*/, auto &res) {
-    auto body =
-        std::format(error_html, res.status, httplib::status_message(res.status),
-                    CPPHTTPLIB_VERSION);
+  if (req) {
+    auto request =
+        std::format("{} {} {}", req->method, req->path, req->version);
+    auto host = req->get_header_value("Host");
+    if (host.empty()) host = "-";

-    res.set_content(body, "text/html");
+    std::cerr << std::format("{} [{}] {}, client: {}, request: "
+                             "\"{}\", host: \"{}\"",
+                             time_local, level, to_string(err),
+                             req->remote_addr, request, host)
+              << std::endl;
+  } else {
+    // If no request context, just log the error
+    std::cerr << std::format("{} [{}] {}", time_local, level, to_string(err))
+              << std::endl;
+  }
+}
+
+void print_usage(const char *program_name) {
+  std::cout << "Usage: " << program_name << " [OPTIONS]" << std::endl;
+  std::cout << std::endl;
+  std::cout << "Options:" << std::endl;
+  std::cout << "  --host <hostname>        Server hostname (default: localhost)"
+            << std::endl;
+  std::cout << "  --port <port>            Server port (default: 8080)"
+            << std::endl;
+  std::cout << "  --mount <mount:path>     Mount point and document root"
+            << std::endl;
+  std::cout << "                           Format: mount_point:document_root"
+            << std::endl;
+  std::cout << "                           (default: /:./html)" << std::endl;
+  std::cout << "  --trusted-proxy <ip>     Add trusted proxy IP address"
+            << std::endl;
+  std::cout << "                           (can be specified multiple times)"
+            << std::endl;
+  std::cout << "  --version                Show version information"
+            << std::endl;
+  std::cout << "  --help                   Show this help message" << std::endl;
+  std::cout << std::endl;
+  std::cout << "Examples:" << std::endl;
+  std::cout << "  " << program_name
+            << " --host localhost --port 8080 --mount /:./html" << std::endl;
+  std::cout << "  " << program_name
+            << " --host 0.0.0.0 --port 3000 --mount /api:./api" << std::endl;
+  std::cout << "  " << program_name
+            << " --trusted-proxy 192.168.1.100 --trusted-proxy 10.0.0.1"
+            << std::endl;
+}
+
+struct ServerConfig {
+  std::string hostname = "localhost";
+  int port = 8080;
+  std::string mount_point = "/";
+  std::string document_root = "./html";
+  std::vector<std::string> trusted_proxies;
+};
+
+enum class ParseResult { SUCCESS, HELP_REQUESTED, VERSION_REQUESTED, ERROR };
+
+ParseResult parse_command_line(int argc, char *argv[], ServerConfig &config) {
+  for (int i = 1; i < argc; i++) {
+    if (strcmp(argv[i], "--help") == 0 || strcmp(argv[i], "-h") == 0) {
+      print_usage(argv[0]);
+      return ParseResult::HELP_REQUESTED;
+    } else if (strcmp(argv[i], "--host") == 0) {
+      if (i + 1 >= argc) {
+        std::cerr << "Error: --host requires a hostname argument" << std::endl;
+        print_usage(argv[0]);
+        return ParseResult::ERROR;
+      }
+      config.hostname = argv[++i];
+    } else if (strcmp(argv[i], "--port") == 0) {
+      if (i + 1 >= argc) {
+        std::cerr << "Error: --port requires a port number argument"
+                  << std::endl;
+        print_usage(argv[0]);
+        return ParseResult::ERROR;
+      }
+      config.port = std::atoi(argv[++i]);
+      if (config.port <= 0 || config.port > 65535) {
+        std::cerr << "Error: Invalid port number. Must be between 1 and 65535"
+                  << std::endl;
+        return ParseResult::ERROR;
+      }
+    } else if (strcmp(argv[i], "--mount") == 0) {
+      if (i + 1 >= argc) {
+        std::cerr
+            << "Error: --mount requires mount_point:document_root argument"
+            << std::endl;
+        print_usage(argv[0]);
+        return ParseResult::ERROR;
+      }
+      std::string mount_arg = argv[++i];
+      auto colon_pos = mount_arg.find(':');
+      if (colon_pos == std::string::npos) {
+        std::cerr << "Error: --mount argument must be in format "
+                     "mount_point:document_root"
+                  << std::endl;
+        print_usage(argv[0]);
+        return ParseResult::ERROR;
+      }
+      config.mount_point = mount_arg.substr(0, colon_pos);
+      config.document_root = mount_arg.substr(colon_pos + 1);
+
+      if (config.mount_point.empty() || config.document_root.empty()) {
+        std::cerr
+            << "Error: Both mount_point and document_root must be non-empty"
+            << std::endl;
+        return ParseResult::ERROR;
+      }
+    } else if (strcmp(argv[i], "--version") == 0) {
+      std::cout << CPPHTTPLIB_VERSION << std::endl;
+      return ParseResult::VERSION_REQUESTED;
+    } else if (strcmp(argv[i], "--trusted-proxy") == 0) {
+      if (i + 1 >= argc) {
+        std::cerr << "Error: --trusted-proxy requires an IP address argument"
+                  << std::endl;
+        print_usage(argv[0]);
+        return ParseResult::ERROR;
+      }
+      config.trusted_proxies.push_back(argv[++i]);
+    } else {
+      std::cerr << "Error: Unknown option '" << argv[i] << "'" << std::endl;
+      print_usage(argv[0]);
+      return ParseResult::ERROR;
+    }
+  }
+  return ParseResult::SUCCESS;
+}
+
+bool setup_server(Server &svr, const ServerConfig &config) {
+  svr.set_logger(nginx_access_logger);
+  svr.set_error_logger(nginx_error_logger);
+
+  // Set trusted proxies if specified
+  if (!config.trusted_proxies.empty()) {
+    svr.set_trusted_proxies(config.trusted_proxies);
+  }
+
+  auto ret = svr.set_mount_point(config.mount_point, config.document_root);
+  if (!ret) {
+    std::cerr
+        << std::format(
+               "Error: Cannot mount '{}' to '{}'. Directory may not exist.",
+               config.mount_point, config.document_root)
+        << std::endl;
+    return false;
+  }
+
+  svr.set_file_extension_and_mimetype_mapping("html", "text/html");
+  svr.set_file_extension_and_mimetype_mapping("htm", "text/html");
+  svr.set_file_extension_and_mimetype_mapping("css", "text/css");
+  svr.set_file_extension_and_mimetype_mapping("js", "text/javascript");
+  svr.set_file_extension_and_mimetype_mapping("json", "application/json");
+  svr.set_file_extension_and_mimetype_mapping("xml", "application/xml");
+  svr.set_file_extension_and_mimetype_mapping("png", "image/png");
+  svr.set_file_extension_and_mimetype_mapping("jpg", "image/jpeg");
+  svr.set_file_extension_and_mimetype_mapping("jpeg", "image/jpeg");
+  svr.set_file_extension_and_mimetype_mapping("gif", "image/gif");
+  svr.set_file_extension_and_mimetype_mapping("svg", "image/svg+xml");
+  svr.set_file_extension_and_mimetype_mapping("ico", "image/x-icon");
+  svr.set_file_extension_and_mimetype_mapping("pdf", "application/pdf");
+  svr.set_file_extension_and_mimetype_mapping("zip", "application/zip");
+  svr.set_file_extension_and_mimetype_mapping("txt", "text/plain");
+
+  svr.set_error_handler([](const Request & /*req*/, Response &res) {
+    if (res.status == 404) {
+      res.set_content(
+          std::format(
+              "<html><head><title>404 Not Found</title></head>"
+              "<body><h1>404 Not Found</h1>"
+              "<p>The requested resource was not found on this server.</p>"
+              "<hr><p>{}</p></body></html>",
+              SERVER_NAME),
+          "text/html");
+    }
  });

-  svr.set_logger(
-      [](auto &req, auto &res) { std::cout << log(req, res) << std::endl; });
+  svr.set_pre_routing_handler([](const Request & /*req*/, Response &res) {
+    res.set_header("Server", SERVER_NAME);
+    return Server::HandlerResponse::Unhandled;
+  });

-  svr.set_mount_point("/", base_dir);
+  signal(SIGINT, signal_handler);
+  signal(SIGTERM, signal_handler);

-  std::cout << std::format("Serving HTTP on {0} port {1} ...", host, port)
+  return true;
+}
+
+int main(int argc, char *argv[]) {
+  ServerConfig config;
+
+  auto result = parse_command_line(argc, argv, config);
+  switch (result) {
+  case ParseResult::HELP_REQUESTED:
+  case ParseResult::VERSION_REQUESTED: return 0;
+  case ParseResult::ERROR: return 1;
+  case ParseResult::SUCCESS: break;
+  }
+
+  if (!setup_server(svr, config)) { return 1; }
+
+  std::cout << "Serving HTTP on " << config.hostname << ":" << config.port
            << std::endl;
+  std::cout << "Mount point: " << config.mount_point << " -> "
+            << config.document_root << std::endl;

-  auto ret = svr.listen(host, port);
+  if (!config.trusted_proxies.empty()) {
+    std::cout << "Trusted proxies: ";
+    for (size_t i = 0; i < config.trusted_proxies.size(); ++i) {
+      if (i > 0) std::cout << ", ";
+      std::cout << config.trusted_proxies[i];
+    }
+    std::cout << std::endl;
+  }
+
+  std::cout << "Press Ctrl+C to shutdown gracefully..." << std::endl;
+
+  auto ret = svr.listen(config.hostname, config.port);
+
+  std::cout << "Server has been shut down." << std::endl;

  return ret ? 0 : 1;
 }
@@ -18,7 +18,7 @@ ZLIB_SUPPORT = -DCPPHTTPLIB_ZLIB_SUPPORT -lz
 BROTLI_DIR = $(PREFIX)/opt/brotli
 BROTLI_SUPPORT = -DCPPHTTPLIB_BROTLI_SUPPORT -I$(BROTLI_DIR)/include -L$(BROTLI_DIR)/lib -lbrotlicommon -lbrotlienc -lbrotlidec

-all: server client hello simplecli simplesvr upload redirect ssesvr ssecli benchmark one_time_request server_and_client accept_header
+all: server client hello simplecli simplesvr upload redirect ssesvr ssecli wsecho benchmark one_time_request server_and_client accept_header

 server : server.cc ../httplib.h Makefile
 	$(CXX) -o server $(CXXFLAGS) server.cc $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT)
@@ -47,6 +47,9 @@ ssesvr : ssesvr.cc ../httplib.h Makefile
 ssecli : ssecli.cc ../httplib.h Makefile
 	$(CXX) -o ssecli $(CXXFLAGS) ssecli.cc $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT)

+wsecho : wsecho.cc ../httplib.h Makefile
+	$(CXX) -o wsecho $(CXXFLAGS) wsecho.cc $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT)
+
 benchmark : benchmark.cc ../httplib.h Makefile
 	$(CXX) -o benchmark $(CXXFLAGS) benchmark.cc $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT)

@@ -64,4 +67,4 @@ pem:
 	openssl req -new -key key.pem | openssl x509 -days 3650 -req -signkey key.pem > cert.pem

 clean:
-	rm server client hello simplecli simplesvr upload redirect ssesvr ssecli benchmark one_time_request server_and_client accept_header *.pem
+	rm server client hello simplecli simplesvr upload redirect ssesvr ssecli wsecho benchmark one_time_request server_and_client accept_header *.pem
@@ -21,7 +21,7 @@ struct StopWatch {
 int main(void) {
  string body(1024 * 5, 'a');

-  httplib::Client cli("httpbin.org", 80);
+  httplib::Client cli("httpcan.org", 80);

  for (int i = 0; i < 3; i++) {
    StopWatch sw(to_string(i).c_str());
@@ -1,7 +1,7 @@
 //
 //  client.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

@@ -30,7 +30,7 @@ int main(void) {
  } else {
    cout << "error code: " << res.error() << std::endl;
 #ifdef CPPHTTPLIB_OPENSSL_SUPPORT
-    auto result = cli.get_openssl_verify_result();
+    auto result = cli.get_verify_result();
    if (result) {
      cout << "verify error: " << X509_verify_cert_error_string(result) << endl;
    }
@@ -1,7 +1,7 @@
 //
 //  hello.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

@@ -1,7 +1,7 @@
 //
 //  redirect.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

@@ -1,7 +1,7 @@
 //
 //  sample.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

@@ -1,7 +1,7 @@
 //
 //  server_and_client.cc
 //
-//  Copyright (c) 2025 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

@@ -1,7 +1,7 @@
 //
 //  simplecli.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

@@ -1,7 +1,7 @@
 //
 //  simplesvr.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

@@ -0,0 +1,234 @@
+//
+//  ssecli-stream.cc
+//
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
+//  MIT License
+//
+//  SSE (Server-Sent Events) client example using Streaming API
+//  with automatic reconnection support (similar to JavaScript's EventSource)
+//
+
+#include <httplib.h>
+
+#include <chrono>
+#include <iostream>
+#include <string>
+#include <thread>
+
+//------------------------------------------------------------------------------
+// SSE Event Parser
+//------------------------------------------------------------------------------
+// Parses SSE events from the stream according to the SSE specification.
+// SSE format:
+//   event: <event-type>     (optional, defaults to "message")
+//   data: <payload>         (can have multiple lines)
+//   id: <event-id>          (optional, used for reconnection)
+//   retry: <milliseconds>   (optional, reconnection interval)
+//   <blank line>            (signals end of event)
+//
+struct SSEEvent {
+  std::string event = "message"; // Event type (default: "message")
+  std::string data;              // Event payload
+  std::string id;                // Event ID for Last-Event-ID header
+
+  void clear() {
+    event = "message";
+    data.clear();
+    id.clear();
+  }
+};
+
+// Parse a single SSE field line (e.g., "data: hello")
+// Returns true if this line ends an event (blank line)
+bool parse_sse_line(const std::string &line, SSEEvent &event, int &retry_ms) {
+  // Blank line signals end of event
+  if (line.empty() || line == "\r") { return true; }
+
+  // Find the colon separator
+  auto colon_pos = line.find(':');
+  if (colon_pos == std::string::npos) {
+    // Line with no colon is treated as field name with empty value
+    return false;
+  }
+
+  std::string field = line.substr(0, colon_pos);
+  std::string value;
+
+  // Value starts after colon, skip optional single space
+  if (colon_pos + 1 < line.size()) {
+    size_t value_start = colon_pos + 1;
+    if (line[value_start] == ' ') { value_start++; }
+    value = line.substr(value_start);
+    // Remove trailing \r if present
+    if (!value.empty() && value.back() == '\r') { value.pop_back(); }
+  }
+
+  // Handle known fields
+  if (field == "event") {
+    event.event = value;
+  } else if (field == "data") {
+    // Multiple data lines are concatenated with newlines
+    if (!event.data.empty()) { event.data += "\n"; }
+    event.data += value;
+  } else if (field == "id") {
+    // Empty id is valid (clears the last event ID)
+    event.id = value;
+  } else if (field == "retry") {
+    // Parse retry interval in milliseconds
+    try {
+      retry_ms = std::stoi(value);
+    } catch (...) {
+      // Invalid retry value, ignore
+    }
+  }
+  // Unknown fields are ignored per SSE spec
+
+  return false;
+}
+
+//------------------------------------------------------------------------------
+// Main - SSE Client with Auto-Reconnection
+//------------------------------------------------------------------------------
+int main(void) {
+  // Configuration
+  const std::string host = "http://localhost:1234";
+  const std::string path = "/event1";
+
+  httplib::Client cli(host);
+
+  // State for reconnection (persists across connections)
+  std::string last_event_id; // Sent as Last-Event-ID header on reconnect
+  int retry_ms = 3000; // Reconnection delay (server can override via retry:)
+  int connection_count = 0;
+
+  std::cout << "SSE Client starting...\n";
+  std::cout << "Target: " << host << path << "\n";
+  std::cout << "Press Ctrl+C to exit\n\n";
+
+  //----------------------------------------------------------------------------
+  // Main reconnection loop
+  // This mimics JavaScript's EventSource behavior:
+  // - Automatically reconnects on connection failure
+  // - Sends Last-Event-ID header to resume from last received event
+  // - Respects server's retry interval
+  //----------------------------------------------------------------------------
+  while (true) {
+    connection_count++;
+    std::cout << "[Connection #" << connection_count << "] Connecting...\n";
+
+    // Build headers, including Last-Event-ID if we have one
+    httplib::Headers headers;
+    if (!last_event_id.empty()) {
+      headers.emplace("Last-Event-ID", last_event_id);
+      std::cout << "[Connection #" << connection_count
+                << "] Resuming from event ID: " << last_event_id << "\n";
+    }
+
+    // Open streaming connection
+    auto result = httplib::stream::Get(cli, path, headers);
+
+    //--------------------------------------------------------------------------
+    // Connection error handling
+    //--------------------------------------------------------------------------
+    if (!result) {
+      std::cerr << "[Connection #" << connection_count
+                << "] Failed: " << httplib::to_string(result.error()) << "\n";
+      std::cerr << "Reconnecting in " << retry_ms << "ms...\n\n";
+      std::this_thread::sleep_for(std::chrono::milliseconds(retry_ms));
+      continue;
+    }
+
+    if (result.status() != 200) {
+      std::cerr << "[Connection #" << connection_count
+                << "] HTTP error: " << result.status() << "\n";
+
+      // For certain errors, don't reconnect
+      if (result.status() == 204 || // No Content - server wants us to stop
+          result.status() == 404 || // Not Found
+          result.status() == 401 || // Unauthorized
+          result.status() == 403) { // Forbidden
+        std::cerr << "Permanent error, not reconnecting.\n";
+        return 1;
+      }
+
+      std::cerr << "Reconnecting in " << retry_ms << "ms...\n\n";
+      std::this_thread::sleep_for(std::chrono::milliseconds(retry_ms));
+      continue;
+    }
+
+    // Verify Content-Type (optional but recommended)
+    auto content_type = result.get_header_value("Content-Type");
+    if (content_type.find("text/event-stream") == std::string::npos) {
+      std::cerr << "[Warning] Content-Type is not text/event-stream: "
+                << content_type << "\n";
+    }
+
+    std::cout << "[Connection #" << connection_count << "] Connected!\n\n";
+
+    //--------------------------------------------------------------------------
+    // Event receiving loop
+    // Reads chunks from the stream and parses SSE events
+    //--------------------------------------------------------------------------
+    std::string buffer;
+    SSEEvent current_event;
+    int event_count = 0;
+
+    // Read data from stream using httplib::stream API
+    while (result.next()) {
+      buffer.append(result.data(), result.size());
+
+      // Process complete lines in the buffer
+      size_t line_start = 0;
+      size_t newline_pos;
+
+      while ((newline_pos = buffer.find('\n', line_start)) !=
+             std::string::npos) {
+        std::string line = buffer.substr(line_start, newline_pos - line_start);
+        line_start = newline_pos + 1;
+
+        // Parse the line and check if event is complete
+        bool event_complete = parse_sse_line(line, current_event, retry_ms);
+
+        if (event_complete && !current_event.data.empty()) {
+          // Event received - process it
+          event_count++;
+
+          std::cout << "--- Event #" << event_count << " ---\n";
+          std::cout << "Type: " << current_event.event << "\n";
+          std::cout << "Data: " << current_event.data << "\n";
+          if (!current_event.id.empty()) {
+            std::cout << "ID:   " << current_event.id << "\n";
+          }
+          std::cout << "\n";
+
+          // Update last_event_id for reconnection
+          // Note: Empty id clears the last event ID per SSE spec
+          if (!current_event.id.empty()) { last_event_id = current_event.id; }
+
+          current_event.clear();
+        }
+      }
+
+      // Keep unprocessed data in buffer
+      buffer.erase(0, line_start);
+    }
+
+    //--------------------------------------------------------------------------
+    // Connection ended - check why
+    //--------------------------------------------------------------------------
+    if (result.read_error() != httplib::Error::Success) {
+      std::cerr << "\n[Connection #" << connection_count
+                << "] Error: " << httplib::to_string(result.read_error())
+                << "\n";
+    } else {
+      std::cout << "\n[Connection #" << connection_count
+                << "] Stream ended normally\n";
+    }
+
+    std::cout << "Received " << event_count << " events in this connection\n";
+    std::cout << "Reconnecting in " << retry_ms << "ms...\n\n";
+    std::this_thread::sleep_for(std::chrono::milliseconds(retry_ms));
+  }
+
+  return 0;
+}
@@ -1,21 +1,57 @@
 //
 //  ssecli.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

 #include <httplib.h>
+
+#include <csignal>
 #include <iostream>

 using namespace std;

-int main(void) {
-  httplib::Client("http://localhost:1234")
-      .Get("/event1", [&](const char *data, size_t data_length) {
-        std::cout << string(data, data_length);
-        return true;
-      });
+// Global SSEClient pointer for signal handling
+httplib::sse::SSEClient *g_sse = nullptr;

+void signal_handler(int) {
+  if (g_sse) { g_sse->stop(); }
+}
+
+int main(void) {
+  // Configuration
+  const string host = "http://localhost:1234";
+  const string path = "/event1";
+
+  cout << "SSE Client using httplib::sse::SSEClient\n";
+  cout << "Connecting to: " << host << path << "\n";
+  cout << "Press Ctrl+C to exit\n\n";
+
+  httplib::Client cli(host);
+  httplib::sse::SSEClient sse(cli, path);
+
+  // Set up signal handler for graceful shutdown
+  g_sse = &sse;
+  signal(SIGINT, signal_handler);
+
+  // Event handlers
+  sse.on_open([]() { cout << "[Connected]\n\n"; });
+
+  sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    cout << "Event: " << msg.event << "\n";
+    cout << "Data:  " << msg.data << "\n";
+    if (!msg.id.empty()) { cout << "ID:    " << msg.id << "\n"; }
+    cout << "\n";
+  });
+
+  sse.on_error([](httplib::Error err) {
+    cerr << "[Error] " << httplib::to_string(err) << "\n";
+  });
+
+  // Start with auto-reconnect (blocking)
+  sse.start();
+
+  cout << "\n[Disconnected]\n";
  return 0;
 }
@@ -14,11 +14,18 @@ class EventDispatcher {
 public:
  EventDispatcher() {}

-  void wait_event(DataSink *sink) {
+  bool wait_event(DataSink *sink) {
    unique_lock<mutex> lk(m_);
    int id = id_;
-    cv_.wait(lk, [&] { return cid_ == id; });
+
+    // Wait with timeout to prevent hanging if client disconnects
+    if (!cv_.wait_for(lk, std::chrono::seconds(5),
+                      [&] { return cid_ == id; })) {
+      return false; // Timeout occurred
+    }
+
    sink->write(message_.data(), message_.size());
+    return true;
  }

  void send_event(const string &message) {
@@ -71,8 +78,7 @@ int main(void) {
    cout << "connected to event1..." << endl;
    res.set_chunked_content_provider("text/event-stream",
                                     [&](size_t /*offset*/, DataSink &sink) {
-                                       ed.wait_event(&sink);
-                                       return true;
+                                       return ed.wait_event(&sink);
                                     });
  });

@@ -80,8 +86,7 @@ int main(void) {
    cout << "connected to event2..." << endl;
    res.set_chunked_content_provider("text/event-stream",
                                     [&](size_t /*offset*/, DataSink &sink) {
-                                       ed.wait_event(&sink);
-                                       return true;
+                                       return ed.wait_event(&sink);
                                     });
  });

@@ -1,7 +1,7 @@
 //
 //  upload.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //

@@ -0,0 +1,135 @@
+#include <httplib.h>
+#include <iostream>
+
+using namespace httplib;
+
+const auto html = R"HTML(
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<title>WebSocket Demo</title>
+<style>
+  body { font-family: monospace; margin: 2em; }
+  #log { height: 300px; overflow-y: scroll; border: 1px solid #ccc; padding: 8px; }
+  .controls { margin: 8px 0; }
+  button { margin-right: 4px; }
+</style>
+</head>
+<body>
+<h1>WebSocket Demo</h1>
+<p>Server accepts subprotocols: <b>echo</b>, <b>chat</b> (or none)</p>
+
+<div class="controls">
+  <label>Subprotocols: </label>
+  <input id="protos" type="text" value="echo, chat" placeholder="leave empty for none" />
+  <button onclick="doConnect()">Connect</button>
+  <button onclick="doDisconnect()">Disconnect</button>
+</div>
+
+<div class="controls">
+  <input id="msg" type="text" placeholder="Type a message..." />
+  <button onclick="doSend()">Send</button>
+</div>
+
+<div class="controls">
+  <button onclick="startAuto()">Start Auto (1s)</button>
+  <button onclick="stopAuto()">Stop Auto</button>
+  <span id="auto-status"></span>
+</div>
+
+<pre id="log"></pre>
+
+<script>
+var sock = null;
+var logEl = document.getElementById("log");
+var statusEl = document.getElementById("auto-status");
+var timer = null;
+var seq = 0;
+
+function appendLog(text) {
+  logEl.textContent += text + "\n";
+  logEl.scrollTop = logEl.scrollHeight;
+}
+
+function doConnect() {
+  if (sock && sock.readyState <= 1) { sock.close(); }
+  var input = document.getElementById("protos").value.trim();
+  var protocols = input ? input.split(/\s*,\s*/).filter(Boolean) : [];
+  sock = new WebSocket("ws://" + location.host + "/ws", protocols);
+  appendLog("[connecting] proposed: " + (protocols.length ? protocols.join(", ") : "(none)"));
+  sock.onopen = function() { appendLog("[connected] subprotocol: " + (sock.protocol || "(none)")); };
+  sock.onclose = function() { appendLog("[disconnected]"); stopAuto(); };
+  sock.onmessage = function(e) { appendLog("< " + e.data); };
+}
+
+function doDisconnect() {
+  if (sock) { sock.close(); }
+}
+
+function doSend() {
+  var input = document.getElementById("msg");
+  if (!sock || sock.readyState !== 1 || input.value === "") return;
+  sock.send(input.value);
+  appendLog("> " + input.value);
+  input.value = "";
+}
+
+function startAuto() {
+  if (timer || !sock || sock.readyState !== 1) return;
+  seq = 0;
+  statusEl.textContent = "running...";
+  timer = setInterval(function() {
+    if (!sock || sock.readyState !== 1) { stopAuto(); return; }
+    var msg = "auto #" + seq++;
+    sock.send(msg);
+    appendLog("> " + msg);
+  }, 1000);
+}
+
+function stopAuto() {
+  if (timer) { clearInterval(timer); timer = null; }
+  statusEl.textContent = "";
+}
+
+document.getElementById("msg").addEventListener("keydown", function(e) {
+  if (e.key === "Enter") doSend();
+});
+
+doConnect();
+</script>
+</body>
+</html>
+)HTML";
+
+int main(void) {
+  Server svr;
+
+  svr.Get("/", [&](const Request & /*req*/, Response &res) {
+    res.set_content(html, "text/html");
+  });
+
+  svr.WebSocket(
+      "/ws",
+      [](const Request &req, ws::WebSocket &ws) {
+        std::cout << "WebSocket connected from " << req.remote_addr
+                  << std::endl;
+
+        std::string msg;
+        while (ws.read(msg)) {
+          std::cout << "Received: " << msg << std::endl;
+          ws.send("echo: " + msg);
+        }
+
+        std::cout << "WebSocket disconnected" << std::endl;
+      },
+      [](const std::vector<std::string> &protocols) -> std::string {
+        for (const auto &p : protocols) {
+          if (p == "echo" || p == "chat") { return p; }
+        }
+        return "";
+      });
+
+  std::cout << "Listening on http://localhost:8080" << std::endl;
+  svr.listen("localhost", 8080);
+}
@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+
+"""This script generates httplib.cppm module file from httplib.h."""
+
+import os
+import sys
+from argparse import ArgumentParser, Namespace
+from typing import List
+
+def main() -> None:
+    """Main entry point for the script."""
+
+    args_parser: ArgumentParser = ArgumentParser(description=__doc__)
+    args_parser.add_argument(
+        "-o", "--out", help="where to write the files (default: out)", default="out"
+    )
+    args: Namespace = args_parser.parse_args()
+
+    cur_dir: str = os.path.dirname(sys.argv[0])
+    if not cur_dir:
+        cur_dir = '.'
+    lib_name: str = "httplib"
+    header_name: str = f"/{lib_name}.h"
+    # get the input file
+    in_file: str = f"{cur_dir}{header_name}"
+    # get the output file
+    cppm_out: str = f"{args.out}/{lib_name}.cppm"
+
+    # if the modification time of the out file is after the in file,
+    # don't generate (as it is already finished)
+    do_generate: bool = True
+
+    if os.path.exists(cppm_out):
+        in_time: float = os.path.getmtime(in_file)
+        out_time: float = os.path.getmtime(cppm_out)
+        do_generate: bool = in_time > out_time
+
+    if do_generate:
+        with open(in_file) as f:
+            lines: List[str] = f.readlines()
+
+        os.makedirs(args.out, exist_ok=True)
+
+        # Find the Headers and Declaration comment markers
+        headers_start: int = -1
+        declaration_start: int = -1
+        for i, line in enumerate(lines):
+            if ' * Headers' in line:
+                headers_start = i - 1  # Include the /* line
+            elif ' * Declaration' in line:
+                declaration_start = i - 1  # Stop before the /* line
+                break
+
+        with open(cppm_out, 'w') as fm:
+            # Write module file
+            fm.write("module;\n\n")
+            
+            # Write global module fragment (from Headers to Declaration comment)
+            # Filter out 'using' declarations to avoid conflicts
+            if headers_start >= 0 and declaration_start >= 0:
+                for i in range(headers_start, declaration_start):
+                    line: str = lines[i]
+                    if 'using' not in line:
+                        fm.write(line)
+            
+            fm.write("\nexport module httplib;\n\n")
+            fm.write("export extern \"C++\" {\n")
+            fm.write(f"{' ' * 4}#include \"httplib.h\"\n")
+            fm.write("}\n")
+
+        print(f"Wrote {cppm_out}")
+    else:
+        print(f"{cppm_out} is up to date")
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,46 @@
+set shell := ["bash", "-c"]
+
+default: list
+
+list:
+    @just --list --unsorted
+
+openssl:
+    @(cd test && LSAN_OPTIONS=suppressions=lsan_suppressions.txt make)
+    @(cd test && make proxy)
+
+openssl_parallel:
+    @(cd test && make test_openssl_parallel)
+
+mbedtls:
+    @(cd test && make test_mbedtls && LSAN_OPTIONS=suppressions=lsan_suppressions.txt ./test_mbedtls)
+    @(cd test && make proxy_mbedtls)
+
+mbedtls_parallel:
+    @(cd test && make test_mbedtls_parallel)
+
+wolfssl:
+    @(cd test && make test_wolfssl && LSAN_OPTIONS=suppressions=lsan_suppressions.txt ./test_wolfssl)
+    @(cd test && make proxy_wolfssl)
+
+wolfssl_parallel:
+    @(cd test && make test_wolfssl_parallel)
+
+no_tls:
+    @(cd test && make test_no_tls && ./test_no_tls)
+
+no_tls_parallel:
+    @(cd test && make test_no_tls_parallel)
+
+others:
+    @(cd test && make fuzz_test)
+    @(cd test && make test_websocket_heartbeat && ./test_websocket_heartbeat)
+    @(cd test && make test_thread_pool && ./test_thread_pool)
+
+build:
+    @(cd test && make test_split)
+    @(cd test && make test_split_mbedtls)
+    @(cd test && make test_split_wolfssl)
+
+bench:
+    @(cd benchmark && make bench-all)
@@ -18,6 +18,14 @@ project(

 cxx = meson.get_compiler('cpp')

+if cxx.sizeof('void *') != 8
+  if host_machine.system() == 'windows'
+    error('unsupported architecture: cpp-httplib doesn\'t support 32-bit Windows. Please use a 64-bit compiler.')
+  else
+    warning('cpp-httplib doesn\'t support 32-bit platforms. Please use a 64-bit compiler.')
+  endif
+endif
+
 # Check just in case downstream decides to edit the source
 # and add a project version
 version = meson.project_version()
@@ -31,12 +39,30 @@ endif
 deps = [dependency('threads')]
 args = []

-openssl_dep = dependency('openssl', version: '>=3.0.0', required: get_option('cpp-httplib_openssl'))
-if openssl_dep.found()
-  deps += openssl_dep
-  args += '-DCPPHTTPLIB_OPENSSL_SUPPORT'
-  if host_machine.system() == 'darwin'
-    macosx_keychain_dep = dependency('appleframeworks', modules: ['CoreFoundation', 'Security'], required: get_option('cpp-httplib_macosx_keychain'))
+if get_option('tls').allowed()
+  tls_found = false
+  if get_option('tls_backend') == 'openssl'
+    openssl_dep = dependency('openssl', version: '>=3.0.0', required: get_option('tls'))
+    if openssl_dep.found()
+      deps += openssl_dep
+      args += '-DCPPHTTPLIB_OPENSSL_SUPPORT'
+      tls_found = true
+    endif
+  else
+    mbedtls_dep = dependency('mbedtls', required: get_option('tls'))
+    mbedtlsx509_dep = dependency('mbedx509', required: get_option('tls'))
+    mbedtlscrypto_dep = dependency('mbedcrypto', required: get_option('tls'))
+    if mbedtls_dep.found() and mbedtlsx509_dep.found() and mbedtlscrypto_dep.found()
+      deps += mbedtls_dep
+      deps += mbedtlsx509_dep
+      deps += mbedtlscrypto_dep
+      args += '-DCPPHTTPLIB_MBEDTLS_SUPPORT'
+      tls_found = true
+    endif
+  endif
+
+  if tls_found and host_machine.system() == 'darwin'
+    macosx_keychain_dep = dependency('appleframeworks', modules: ['CFNetwork', 'CoreFoundation', 'Security'], required: get_option('macosx_keychain'))
    if macosx_keychain_dep.found()
        deps += macosx_keychain_dep
        args += '-DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN'
@@ -44,15 +70,15 @@ if openssl_dep.found()
  endif
 endif

-zlib_dep = dependency('zlib', required: get_option('cpp-httplib_zlib'))
+zlib_dep = dependency('zlib', required: get_option('zlib'))
 if zlib_dep.found()
  deps += zlib_dep
  args += '-DCPPHTTPLIB_ZLIB_SUPPORT'
 endif

-brotli_deps = [dependency('libbrotlicommon', required: get_option('cpp-httplib_brotli'))]
-brotli_deps += dependency('libbrotlidec',    required: get_option('cpp-httplib_brotli'))
-brotli_deps += dependency('libbrotlienc',    required: get_option('cpp-httplib_brotli'))
+brotli_deps = [dependency('libbrotlicommon', required: get_option('brotli'))]
+brotli_deps += dependency('libbrotlidec',    required: get_option('brotli'))
+brotli_deps += dependency('libbrotlienc',    required: get_option('brotli'))

 brotli_found_all = true
 foreach brotli_dep : brotli_deps
@@ -66,12 +92,18 @@ if brotli_found_all
  args += '-DCPPHTTPLIB_BROTLI_SUPPORT'
 endif

-async_ns_opt = get_option('cpp-httplib_non_blocking_getaddrinfo')
+zstd_dep = dependency('libzstd', required: get_option('zstd'))
+if zstd_dep.found()
+  deps += zstd_dep
+  args += '-DCPPHTTPLIB_ZSTD_SUPPORT'
+endif
+
+async_ns_opt = get_option('non_blocking_getaddrinfo')

 if host_machine.system() == 'windows'
  async_ns_dep = cxx.find_library('ws2_32', required: async_ns_opt)
 elif host_machine.system() == 'darwin'
-  async_ns_dep = dependency('appleframeworks', modules: ['CFNetwork'], required: async_ns_opt)
+  async_ns_dep = dependency('appleframeworks', modules: ['CFNetwork', 'CoreFoundation'], required: async_ns_opt)
 else
  async_ns_dep = cxx.find_library('anl', required: async_ns_opt)
 endif
@@ -83,7 +115,7 @@ endif

 cpp_httplib_dep = dependency('', required: false)

-if get_option('cpp-httplib_compile')
+if get_option('compile')
  python3 = find_program('python3')

  httplib_ch = custom_target(
@@ -127,6 +159,6 @@ endif

 meson.override_dependency('cpp-httplib', cpp_httplib_dep)

-if get_option('cpp-httplib_test')
+if get_option('test')
  subdir('test')
 endif
@@ -2,15 +2,18 @@
 #
 # SPDX-License-Identifier: MIT

-option('openssl', type: 'feature', value: 'auto', description: 'Enable OpenSSL support')
+option('tls',     type: 'feature', description: 'Enable TLS support')
+option('tls_backend', type: 'combo', choices: ['openssl', 'mbedtls'], value: 'openssl', description: 'Which TLS library to use')
 option('zlib',    type: 'feature', value: 'auto', description: 'Enable zlib support')
 option('brotli',  type: 'feature', value: 'auto', description: 'Enable Brotli support')
+option('zstd',    type: 'feature', value: 'auto', description: 'Enable zstd support')
 option('macosx_keychain', type: 'feature', value: 'auto', description: 'Enable loading certs from the Keychain on Apple devices')
 option('non_blocking_getaddrinfo', type: 'feature', value: 'auto', description: 'Enable asynchronous name lookup')
 option('compile', type: 'boolean', value: false,  description: 'Split the header into a compilable header & source file (requires python3)')
 option('test',    type: 'boolean', value: false,  description: 'Build tests')

 # Old option names
+option('openssl', type: 'feature', deprecated: 'tls')
 option('cpp-httplib_openssl', type: 'feature', deprecated: 'openssl')
 option('cpp-httplib_zlib',    type: 'feature', deprecated: 'zlib')
 option('cpp-httplib_brotli',  type: 'feature', deprecated: 'brotli')
@@ -2,66 +2,76 @@

 """This script splits httplib.h into .h and .cc parts."""

-import argparse
 import os
 import sys
+from argparse import ArgumentParser, Namespace
+from typing import List

-border = '// ----------------------------------------------------------------------------'
+BORDER: str = '// ----------------------------------------------------------------------------'

-args_parser = argparse.ArgumentParser(description=__doc__)
-args_parser.add_argument(
-    "-e", "--extension", help="extension of the implementation file (default: cc)",
-    default="cc"
-)
-args_parser.add_argument(
-    "-o", "--out", help="where to write the files (default: out)", default="out"
-)
-args = args_parser.parse_args()
+def main() -> None:
+    """Main entry point for the script."""

-cur_dir = os.path.dirname(sys.argv[0])
-lib_name = 'httplib'
-header_name = '/' + lib_name + '.h'
-source_name = '/' + lib_name + '.' + args.extension
-# get the input file
-in_file = cur_dir + header_name
-# get the output file
-h_out = args.out + header_name
-cc_out = args.out + source_name
+    args_parser: ArgumentParser = ArgumentParser(description=__doc__)
+    args_parser.add_argument(
+        "-e", "--extension", help="extension of the implementation file (default: cc)", default="cc"
+    )
+    args_parser.add_argument(
+        "-o", "--out", help="where to write the files (default: out)", default="out"
+    )
+    args: Namespace = args_parser.parse_args()

-# if the modification time of the out file is after the in file,
-# don't split (as it is already finished)
-do_split = True
+    cur_dir: str = os.path.dirname(sys.argv[0])
+    if not cur_dir:
+        cur_dir = '.'
+    lib_name: str = "httplib"
+    header_name: str = f"/{lib_name}.h"
+    source_name: str = f"/{lib_name}.{args.extension}"
+    # get the input file
+    in_file: str = f"{cur_dir}{header_name}"
+    # get the output file
+    h_out: str = f"{args.out}{header_name}"
+    cc_out: str = f"{args.out}{source_name}"

-if os.path.exists(h_out):
-    in_time = os.path.getmtime(in_file)
-    out_time = os.path.getmtime(h_out)
-    do_split = in_time > out_time
+    # if the modification time of the out file is after the in file,
+    # don't split (as it is already finished)
+    do_split: bool = True

-if do_split:
-    with open(in_file) as f:
-        lines = f.readlines()
+    if os.path.exists(h_out):
+        in_time: float = os.path.getmtime(in_file)
+        out_time: float = os.path.getmtime(h_out)
+        do_split: bool = in_time > out_time
+
+    if do_split:
+        with open(in_file) as f:
+            lines: List[str] = f.readlines()

-    python_version = sys.version_info[0]
-    if python_version < 3:
-        os.makedirs(args.out)
-    else:
        os.makedirs(args.out, exist_ok=True)

-    in_implementation = False
-    cc_out = args.out + source_name
-    with open(h_out, 'w') as fh, open(cc_out, 'w') as fc:
-        fc.write('#include "httplib.h"\n')
-        fc.write('namespace httplib {\n')
-        for line in lines:
-            is_border_line = border in line
-            if is_border_line:
-                in_implementation = not in_implementation
-            elif in_implementation:
-                fc.write(line.replace('inline ', ''))
-            else:
-                fh.write(line)
-        fc.write('} // namespace httplib\n')
+        in_implementation: bool = False
+        cc_out: str = args.out + source_name
+        
+        with open(h_out, 'w') as fh, open(cc_out, 'w') as fc:
+            # Write source file
+            fc.write("#include \"httplib.h\"\n")
+            fc.write("namespace httplib {\n")
+            
+            # Process lines for header and source split
+            for line in lines:
+                is_border_line: bool = BORDER in line
+                if is_border_line:
+                    in_implementation: bool = not in_implementation
+                elif in_implementation:
+                    fc.write(line.replace("inline ", ""))
+                else:
+                    fh.write(line)
+            
+            fc.write("} // namespace httplib\n")

-    print("Wrote {} and {}".format(h_out, cc_out))
-else:
-    print("{} and {} are up to date".format(h_out, cc_out))
+        print(f"Wrote {h_out} and {cc_out}")
+    else:
+        print(f"{h_out} and {cc_out} are up to date")
+
+
+if __name__ == "__main__":
+    main()
@@ -1,38 +1,49 @@
 CXX = clang++
-CXXFLAGS = -g -std=c++11 -I. -Wall -Wextra -Wtype-limits -Wconversion -Wshadow $(EXTRA_CXXFLAGS) -DCPPHTTPLIB_USE_NON_BLOCKING_GETADDRINFO # -fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS -fsanitize=address
-
-PREFIX ?= $(shell brew --prefix)
-
-OPENSSL_DIR = $(PREFIX)/opt/openssl@3
-OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -I$(OPENSSL_DIR)/include -L$(OPENSSL_DIR)/lib -lssl -lcrypto
+CXXFLAGS = -g -std=c++11 -I. -Wall -Wextra -Wtype-limits -Wconversion -Wshadow $(EXTRA_CXXFLAGS) -DCPPHTTPLIB_USE_NON_BLOCKING_GETADDRINFO -fsanitize=address # -fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS

 ifneq ($(OS), Windows_NT)
 	UNAME_S := $(shell uname -s)
 	ifeq ($(UNAME_S), Darwin)
+		PREFIX ?= $(shell brew --prefix)
+		OPENSSL_DIR = $(PREFIX)/opt/openssl@3
+		OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -I$(OPENSSL_DIR)/include -L$(OPENSSL_DIR)/lib -lssl -lcrypto
 		OPENSSL_SUPPORT += -DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN -framework Security
+		MBEDTLS_DIR ?= $(shell brew --prefix mbedtls@3)
+		MBEDTLS_SUPPORT = -DCPPHTTPLIB_MBEDTLS_SUPPORT -I$(MBEDTLS_DIR)/include -L$(MBEDTLS_DIR)/lib -lmbedtls -lmbedx509 -lmbedcrypto
+		MBEDTLS_SUPPORT += -DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN -framework Security
+		WOLFSSL_DIR ?= $(shell brew --prefix wolfssl)
+		WOLFSSL_SUPPORT = -DCPPHTTPLIB_WOLFSSL_SUPPORT -I$(WOLFSSL_DIR)/include -I$(WOLFSSL_DIR)/include/wolfssl -L$(WOLFSSL_DIR)/lib -lwolfssl
+		WOLFSSL_SUPPORT += -DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN -framework Security
+	else
+		OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -lssl -lcrypto
+		MBEDTLS_SUPPORT = -DCPPHTTPLIB_MBEDTLS_SUPPORT -lmbedtls -lmbedx509 -lmbedcrypto
+		WOLFSSL_SUPPORT = -DCPPHTTPLIB_WOLFSSL_SUPPORT -lwolfssl
 	endif
 endif

 ZLIB_SUPPORT = -DCPPHTTPLIB_ZLIB_SUPPORT -lz

-BROTLI_DIR = $(PREFIX)/opt/brotli
-BROTLI_SUPPORT = -DCPPHTTPLIB_BROTLI_SUPPORT -I$(BROTLI_DIR)/include -L$(BROTLI_DIR)/lib -lbrotlicommon -lbrotlienc -lbrotlidec
-
-ZSTD_DIR = $(PREFIX)/opt/zstd
-ZSTD_SUPPORT = -DCPPHTTPLIB_ZSTD_SUPPORT -I$(ZSTD_DIR)/include -L$(ZSTD_DIR)/lib -lzstd
-
-LIBS = -lpthread -lcurl
 ifneq ($(OS), Windows_NT)
 	UNAME_S := $(shell uname -s)
 	ifeq ($(UNAME_S), Darwin)
-		LIBS += -framework CoreFoundation -framework CFNetwork
-	endif
-	ifneq ($(UNAME_S), Darwin)
-		LIBS += -lanl
+		# macOS: use Homebrew paths for brotli and zstd
+		BROTLI_DIR = $(PREFIX)/opt/brotli
+		BROTLI_SUPPORT = -DCPPHTTPLIB_BROTLI_SUPPORT -I$(BROTLI_DIR)/include -L$(BROTLI_DIR)/lib -lbrotlicommon -lbrotlienc -lbrotlidec
+		ZSTD_DIR = $(PREFIX)/opt/zstd
+		ZSTD_SUPPORT = -DCPPHTTPLIB_ZSTD_SUPPORT -I$(ZSTD_DIR)/include -L$(ZSTD_DIR)/lib -lzstd
+		LIBS = -lpthread -lcurl -framework CoreFoundation -framework CFNetwork
+	else
+		# Linux: use system paths
+		BROTLI_SUPPORT = -DCPPHTTPLIB_BROTLI_SUPPORT -lbrotlicommon -lbrotlienc -lbrotlidec
+		ZSTD_SUPPORT = -DCPPHTTPLIB_ZSTD_SUPPORT -lzstd
+		LIBS = -lpthread -lcurl -lanl
 	endif
 endif

 TEST_ARGS = gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT) $(ZSTD_SUPPORT) $(LIBS)
+TEST_ARGS_MBEDTLS = gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include $(MBEDTLS_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT) $(ZSTD_SUPPORT) $(LIBS)
+TEST_ARGS_WOLFSSL = gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include $(WOLFSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT) $(ZSTD_SUPPORT) $(LIBS)
+TEST_ARGS_NO_TLS = gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include $(ZLIB_SUPPORT) $(BROTLI_SUPPORT) $(ZSTD_SUPPORT) $(LIBS)

 # By default, use standalone_fuzz_target_runner.
 # This runner does no fuzzing, but simply executes the inputs
@@ -48,7 +59,46 @@ STYLE_CHECK_FILES = $(filter-out httplib.h httplib.cc, \
 	$(wildcard example/*.h example/*.cc fuzzing/*.h fuzzing/*.cc *.h *.cc ../httplib.h))

 all : test test_split
-	./test
+	LSAN_OPTIONS=suppressions=lsan_suppressions.txt ./test
+
+SHARDS ?= 4
+
+define run_parallel
+	@echo "Running $(1) with $(SHARDS) shards in parallel..."
+	@fail=0; \
+	for i in $$(seq 0 $$(($(SHARDS) - 1))); do \
+	  GTEST_TOTAL_SHARDS=$(SHARDS) GTEST_SHARD_INDEX=$$i \
+	  LSAN_OPTIONS=suppressions=lsan_suppressions.txt \
+	  ./$(1) --gtest_color=yes > $(1)_shard_$$i.log 2>&1 & \
+	done; \
+	wait; \
+	for i in $$(seq 0 $$(($(SHARDS) - 1))); do \
+	  if ! grep -q "\[  PASSED  \]" $(1)_shard_$$i.log; then \
+	    echo "=== Shard $$i FAILED ==="; \
+	    cat $(1)_shard_$$i.log; \
+	    fail=1; \
+	  else \
+	    passed=$$(grep "\[  PASSED  \]" $(1)_shard_$$i.log); \
+	    echo "Shard $$i: $$passed"; \
+	  fi; \
+	done; \
+	if [ $$fail -ne 0 ]; then exit 1; fi; \
+	echo "All shards passed."
+endef
+
+.PHONY: test_openssl_parallel test_mbedtls_parallel test_wolfssl_parallel test_no_tls_parallel
+
+test_openssl_parallel : test
+	$(call run_parallel,test)
+
+test_mbedtls_parallel : test_mbedtls
+	$(call run_parallel,test_mbedtls)
+
+test_wolfssl_parallel : test_wolfssl
+	$(call run_parallel,test_wolfssl)
+
+test_no_tls_parallel : test_no_tls
+	$(call run_parallel,test_no_tls)

 proxy : test_proxy
 	@echo "Starting proxy server..."
@@ -69,6 +119,44 @@ proxy : test_proxy
 	cd proxy && docker compose down; \
 	exit $$exit_code

+proxy_mbedtls : test_proxy_mbedtls
+	@echo "Starting proxy server..."
+	cd proxy && \
+	docker compose up -d
+	@echo "Waiting for proxy to be ready..."
+	@until nc -z localhost 3128 && nc -z localhost 3129; do sleep 1; done
+	@echo "Proxy servers are ready, waiting additional 5 seconds for full startup..."
+	@sleep 5
+	@echo "Checking proxy server status..."
+	@cd proxy && docker compose ps
+	@echo "Checking proxy server logs..."
+	@cd proxy && docker compose logs --tail=20
+	@echo "Running proxy tests (Mbed TLS)..."
+	./test_proxy_mbedtls; \
+	exit_code=$$?; \
+	echo "Stopping proxy server..."; \
+	cd proxy && docker compose down; \
+	exit $$exit_code
+
+proxy_wolfssl : test_proxy_wolfssl
+	@echo "Starting proxy server..."
+	cd proxy && \
+	docker compose up -d
+	@echo "Waiting for proxy to be ready..."
+	@until nc -z localhost 3128 && nc -z localhost 3129; do sleep 1; done
+	@echo "Proxy servers are ready, waiting additional 5 seconds for full startup..."
+	@sleep 5
+	@echo "Checking proxy server status..."
+	@cd proxy && docker compose ps
+	@echo "Checking proxy server logs..."
+	@cd proxy && docker compose logs --tail=20
+	@echo "Running proxy tests (wolfSSL)..."
+	./test_proxy_wolfssl; \
+	exit_code=$$?; \
+	echo "Stopping proxy server..."; \
+	cd proxy && docker compose down; \
+	exit $$exit_code
+
 test : test.cc include_httplib.cc ../httplib.h Makefile cert.pem
 	$(CXX) -o $@ -I.. $(CXXFLAGS) test.cc include_httplib.cc $(TEST_ARGS)
 	@file $@
@@ -78,6 +166,34 @@ test : test.cc include_httplib.cc ../httplib.h Makefile cert.pem
 test_split : test.cc ../httplib.h httplib.cc Makefile cert.pem
 	$(CXX) -o $@ $(CXXFLAGS) test.cc httplib.cc $(TEST_ARGS)

+# Mbed TLS backend targets
+test_mbedtls : test.cc include_httplib.cc ../httplib.h Makefile cert.pem
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test.cc include_httplib.cc $(TEST_ARGS_MBEDTLS)
+	@file $@
+
+test_split_mbedtls : test.cc ../httplib.h httplib.cc Makefile cert.pem
+	$(CXX) -o $@ $(CXXFLAGS) test.cc httplib.cc $(TEST_ARGS_MBEDTLS)
+
+# wolfSSL backend targets
+test_wolfssl : test.cc include_httplib.cc ../httplib.h Makefile cert.pem
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test.cc include_httplib.cc $(TEST_ARGS_WOLFSSL)
+	@file $@
+
+test_split_wolfssl : test.cc ../httplib.h httplib.cc Makefile cert.pem
+	$(CXX) -o $@ $(CXXFLAGS) test.cc httplib.cc $(TEST_ARGS_WOLFSSL)
+
+# No TLS
+test_no_tls : test.cc include_httplib.cc ../httplib.h Makefile
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test.cc include_httplib.cc $(TEST_ARGS_NO_TLS)
+	@file $@
+
+test_split_no_tls : test.cc ../httplib.h httplib.cc Makefile
+	$(CXX) -o $@ $(CXXFLAGS) test.cc httplib.cc $(TEST_ARGS_NO_TLS)
+
+# ThreadPool unit tests (no TLS, no compression needed)
+test_thread_pool : test_thread_pool.cc ../httplib.h Makefile
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test_thread_pool.cc gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include -lpthread
+
 check_abi:
 	@./check-shared-library-abi-compatibility.sh

@@ -103,9 +219,19 @@ style_check: $(STYLE_CHECK_FILES)
 		echo "All files are properly formatted."; \
 	fi

+test_websocket_heartbeat : test_websocket_heartbeat.cc ../httplib.h Makefile
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test_websocket_heartbeat.cc $(TEST_ARGS)
+	@file $@
+
 test_proxy : test_proxy.cc ../httplib.h Makefile cert.pem
 	$(CXX) -o $@ -I.. $(CXXFLAGS) test_proxy.cc $(TEST_ARGS)

+test_proxy_mbedtls : test_proxy.cc ../httplib.h Makefile cert.pem
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test_proxy.cc $(TEST_ARGS_MBEDTLS)
+
+test_proxy_wolfssl : test_proxy.cc ../httplib.h Makefile cert.pem
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test_proxy.cc $(TEST_ARGS_WOLFSSL)
+
 # Runs server_fuzzer.cc based on value of $(LIB_FUZZING_ENGINE).
 # Usage: make fuzz_test LIB_FUZZING_ENGINE=/path/to/libFuzzer
 fuzz_test: server_fuzzer
@@ -128,5 +254,5 @@ cert.pem:
 	./gen-certs.sh

 clean:
-	rm -rf test test_split test_proxy server_fuzzer *.pem *.0 *.o *.1 *.srl httplib.h httplib.cc _build* *.dSYM
+	rm -rf test test_split test_mbedtls test_split_mbedtls test_wolfssl test_split_wolfssl test_no_tls, test_split_no_tls test_proxy test_proxy_mbedtls test_proxy_wolfssl server_fuzzer *.pem *.0 *.o *.1 *.srl httplib.h httplib.cc _build* *.dSYM *_shard_*.log

@@ -14,5 +14,5 @@ openssl genrsa 2048 > client.key.pem
 openssl req -new -batch -config test.conf -key client.key.pem | openssl x509 -days 370 -req -CA rootCA.cert.pem -CAkey rootCA.key.pem -CAcreateserial > client.cert.pem
 openssl genrsa -passout pass:test123! 2048 > key_encrypted.pem
 openssl req -new -batch -config test.conf -key key_encrypted.pem | openssl x509 -days 3650 -req -signkey key_encrypted.pem > cert_encrypted.pem
-openssl genrsa -aes256 -passout pass:test012! 2048 > client_encrypted.key.pem
+openssl genrsa 2048 | openssl pkcs8 -topk8 -v1 PBE-SHA1-3DES -passout pass:test012! -out client_encrypted.key.pem
 openssl req -new -batch -config test.conf -key client_encrypted.key.pem -passin pass:test012! | openssl x509 -days 370 -req -CA rootCA.cert.pem -CAkey rootCA.key.pem -CAcreateserial > client_encrypted.cert.pem
@@ -993,7 +993,7 @@ void UniversalTersePrint(const T& value, ::std::ostream* os) {
 // NUL-terminated string.
 template <typename T>
 void UniversalPrint(const T& value, ::std::ostream* os) {
-  // A workarond for the bug in VC++ 7.1 that prevents us from instantiating
+  // A workaround for the bug in VC++ 7.1 that prevents us from instantiating
  // UniversalPrinter with T directly.
  typedef T T1;
  UniversalPrinter<T1>::Print(value, os);
@@ -753,7 +753,7 @@ class ParameterizedTestSuiteRegistry {
 };

 // Keep track of what type-parameterized test suite are defined and
-// where as well as which are intatiated. This allows susequently
+// where as well as which are intatiated. This allows subsequently
 // identifying suits that are defined but never used.
 class TypeParameterizedTestSuiteRegistry {
 public:
@@ -764,7 +764,7 @@ class TypeParameterizedTestSuiteRegistry {
  // Add an instantiation of a suit.
  void RegisterInstantiation(const char* test_suite_name);

-  // For each suit repored as defined but not reported as instantiation,
+  // For each suit reported as defined but not reported as instantiation,
  // emit a test that reports that fact (configurably, as an error).
  void CheckForInstantiations();

@@ -0,0 +1,3 @@
+# OpenSSL 3.x internal caches (provider, cipher, keymgmt) are allocated
+# lazily and intentionally kept until process exit. These are not real leaks.
+leak:libcrypto
@@ -108,9 +108,11 @@ subdir('www')
 subdir('www2'/'dir')
 subdir('www3'/'dir')

-# GoogleTest 1.13.0 requires C++14
+# New GoogleTest versions require new C++ standards
 test_options = []
-if gtest_dep.version().version_compare('>=1.13.0')
+if gtest_dep.version().version_compare('>=1.17.0')
+  test_options += 'cpp_std=c++17'
+elif gtest_dep.version().version_compare('>=1.13.0')
  test_options += 'cpp_std=c++14'
 endif

@@ -26,7 +26,7 @@ TEST(ProxyTest, NoSSLBasic) {
  ProxyTest(cli, true);
 }

-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(ProxyTest, SSLBasic) {
  SSLClient cli("nghttp2.org");
  ProxyTest(cli, true);
@@ -51,7 +51,7 @@ void RedirectProxyText(T &cli, const char *path, bool basic) {
  if (basic) {
    cli.set_proxy_basic_auth("hello", "world");
  } else {
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
    cli.set_proxy_digest_auth("hello", "world");
 #endif
  }
@@ -67,7 +67,7 @@ TEST(RedirectTest, HTTPBinNoSSLBasic) {
  RedirectProxyText(cli, "/httpbin/redirect/2", true);
 }

-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(RedirectTest, HTTPBinNoSSLDigest) {
  Client cli("nghttp2.org");
  RedirectProxyText(cli, "/httpbin/redirect/2", false);
@@ -84,7 +84,7 @@ TEST(RedirectTest, HTTPBinSSLDigest) {
 }
 #endif

-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(RedirectTest, YouTubeNoSSLBasic) {
  Client cli("youtube.com");
  RedirectProxyText(cli, "/", true);
@@ -153,20 +153,20 @@ template <typename T> void BaseAuthTestFromHTTPWatch(T &cli) {
 }

 TEST(BaseAuthTest, NoSSL) {
-  Client cli("httpbin.org");
+  Client cli("httpcan.org");
  BaseAuthTestFromHTTPWatch(cli);
 }

-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(BaseAuthTest, SSL) {
-  SSLClient cli("httpbin.org");
+  SSLClient cli("httpcan.org");
  BaseAuthTestFromHTTPWatch(cli);
 }
 #endif

 // ----------------------------------------------------------------------------

-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 template <typename T> void DigestAuthTestFromHTTPWatch(T &cli) {
  cli.set_proxy("localhost", 3129);
  cli.set_proxy_digest_auth("hello", "world");
@@ -182,15 +182,17 @@ template <typename T> void DigestAuthTestFromHTTPWatch(T &cli) {
        "/digest-auth/auth/hello/world/MD5",
        "/digest-auth/auth/hello/world/SHA-256",
        "/digest-auth/auth/hello/world/SHA-512",
-        "/digest-auth/auth-int/hello/world/MD5",
    };

    cli.set_digest_auth("hello", "world");
    for (auto path : paths) {
      auto res = cli.Get(path.c_str());
      ASSERT_TRUE(res != nullptr);
-      EXPECT_EQ(normalizeJson("{\"authenticated\":true,\"user\":\"hello\"}\n"),
-                normalizeJson(res->body));
+      std::string algo(path.substr(path.rfind('/') + 1));
+      EXPECT_EQ(
+          normalizeJson("{\"algorithm\":\"" + algo +
+                        "\",\"authenticated\":true,\"user\":\"hello\"}\n"),
+          normalizeJson(res->body));
      EXPECT_EQ(StatusCode::OK_200, res->status);
    }

@@ -201,24 +203,22 @@ template <typename T> void DigestAuthTestFromHTTPWatch(T &cli) {
      EXPECT_EQ(StatusCode::Unauthorized_401, res->status);
    }

-    // NOTE: Until httpbin.org fixes issue #46, the following test is commented
-    // out. Please see https://httpbin.org/digest-auth/auth/hello/world
-    // cli.set_digest_auth("bad", "world");
-    // for (auto path : paths) {
-    //   auto res = cli.Get(path.c_str());
-    //   ASSERT_TRUE(res != nullptr);
-    //   EXPECT_EQ(StatusCode::Unauthorized_401, res->status);
-    // }
+    cli.set_digest_auth("bad", "world");
+    for (auto path : paths) {
+      auto res = cli.Get(path.c_str());
+      ASSERT_TRUE(res != nullptr);
+      EXPECT_EQ(StatusCode::Unauthorized_401, res->status);
+    }
  }
 }

 TEST(DigestAuthTest, SSL) {
-  SSLClient cli("httpbin.org");
+  SSLClient cli("httpcan.org");
  DigestAuthTestFromHTTPWatch(cli);
 }

 TEST(DigestAuthTest, NoSSL) {
-  Client cli("httpbin.org");
+  Client cli("httpcan.org");
  DigestAuthTestFromHTTPWatch(cli);
 }
 #endif
@@ -230,13 +230,13 @@ template <typename T> void KeepAliveTest(T &cli, bool basic) {
  if (basic) {
    cli.set_proxy_basic_auth("hello", "world");
  } else {
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
    cli.set_proxy_digest_auth("hello", "world");
 #endif
  }

  cli.set_follow_location(true);
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
  cli.set_digest_auth("hello", "world");
 #endif

@@ -274,7 +274,7 @@ template <typename T> void KeepAliveTest(T &cli, bool basic) {
  }
 }

-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(KeepAliveTest, NoSSLWithBasic) {
  Client cli("nghttp2.org");
  KeepAliveTest(cli, true);
@@ -0,0 +1,228 @@
+// ThreadPool unit tests
+// Set a short idle timeout for faster shrink tests
+#define CPPHTTPLIB_THREAD_POOL_IDLE_TIMEOUT 1
+
+#include <httplib.h>
+
+#include <gtest/gtest.h>
+
+#include <atomic>
+#include <chrono>
+#include <thread>
+#include <vector>
+
+using namespace httplib;
+
+TEST(ThreadPoolTest, BasicTaskExecution) {
+  ThreadPool pool(4);
+  std::atomic<int> count(0);
+
+  for (int i = 0; i < 10; i++) {
+    pool.enqueue([&count]() { count++; });
+  }
+
+  pool.shutdown();
+  EXPECT_EQ(10, count.load());
+}
+
+TEST(ThreadPoolTest, FixedPoolWhenMaxEqualsBase) {
+  // max_n == 0 means max = base (fixed pool behavior)
+  ThreadPool pool(4);
+  std::atomic<int> count(0);
+
+  for (int i = 0; i < 100; i++) {
+    pool.enqueue([&count]() { count++; });
+  }
+
+  pool.shutdown();
+  EXPECT_EQ(100, count.load());
+}
+
+TEST(ThreadPoolTest, DynamicScaleUp) {
+  // base=2, max=8: block 2 base threads, then enqueue more tasks
+  ThreadPool pool(2, 8);
+
+  std::atomic<int> active(0);
+  std::atomic<int> max_active(0);
+  std::atomic<int> completed(0);
+  std::mutex barrier_mutex;
+  std::condition_variable barrier_cv;
+  bool release = false;
+
+  // Occupy all base threads with blocking tasks
+  for (int i = 0; i < 2; i++) {
+    pool.enqueue([&]() {
+      active++;
+      {
+        std::unique_lock<std::mutex> lock(barrier_mutex);
+        barrier_cv.wait(lock, [&] { return release; });
+      }
+      active--;
+      completed++;
+    });
+  }
+
+  // Wait for base threads to be occupied
+  std::this_thread::sleep_for(std::chrono::milliseconds(100));
+
+  // These should trigger dynamic thread creation
+  for (int i = 0; i < 4; i++) {
+    pool.enqueue([&]() {
+      int cur = ++active;
+      // Track peak active count
+      int prev = max_active.load();
+      while (cur > prev && !max_active.compare_exchange_weak(prev, cur)) {}
+      std::this_thread::sleep_for(std::chrono::milliseconds(50));
+      active--;
+      completed++;
+    });
+  }
+
+  // Wait for dynamic tasks to complete
+  std::this_thread::sleep_for(std::chrono::milliseconds(500));
+
+  // Release the blocking tasks
+  {
+    std::unique_lock<std::mutex> lock(barrier_mutex);
+    release = true;
+  }
+  barrier_cv.notify_all();
+
+  pool.shutdown();
+  EXPECT_EQ(6, completed.load());
+  // More than 2 threads were active simultaneously
+  EXPECT_GT(max_active.load(), 2);
+}
+
+TEST(ThreadPoolTest, DynamicShrinkAfterIdle) {
+  // CPPHTTPLIB_THREAD_POOL_IDLE_TIMEOUT is set to 1 second
+  ThreadPool pool(2, 8);
+
+  std::atomic<int> completed(0);
+
+  // Enqueue tasks that require dynamic threads
+  for (int i = 0; i < 8; i++) {
+    pool.enqueue([&]() {
+      std::this_thread::sleep_for(std::chrono::milliseconds(100));
+      completed++;
+    });
+  }
+
+  // Wait for all tasks to complete + idle timeout + margin
+  std::this_thread::sleep_for(std::chrono::milliseconds(2500));
+
+  // Now enqueue a simple task to verify the pool still works
+  // (base threads are still alive)
+  std::atomic<bool> final_task_done(false);
+  pool.enqueue([&]() { final_task_done = true; });
+
+  std::this_thread::sleep_for(std::chrono::milliseconds(100));
+
+  pool.shutdown();
+  EXPECT_EQ(8, completed.load());
+  EXPECT_TRUE(final_task_done.load());
+}
+
+TEST(ThreadPoolTest, ShutdownWithActiveDynamicThreads) {
+  ThreadPool pool(2, 8);
+
+  std::atomic<int> started(0);
+
+  std::mutex block_mutex;
+  std::condition_variable block_cv;
+  bool release = false;
+
+  // Start tasks on dynamic threads that block until released
+  for (int i = 0; i < 6; i++) {
+    pool.enqueue([&]() {
+      started++;
+      std::unique_lock<std::mutex> lock(block_mutex);
+      block_cv.wait(lock, [&] { return release; });
+    });
+  }
+
+  // Wait for tasks to start
+  std::this_thread::sleep_for(std::chrono::milliseconds(200));
+  EXPECT_GE(started.load(), 2);
+
+  // Release all blocked threads, then shutdown
+  {
+    std::unique_lock<std::mutex> lock(block_mutex);
+    release = true;
+  }
+  block_cv.notify_all();
+
+  pool.shutdown();
+}
+
+TEST(ThreadPoolTest, MaxQueuedRequests) {
+  // base=2, max=2 (fixed), mqr=3
+  ThreadPool pool(2, 2, 3);
+
+  std::mutex block_mutex;
+  std::condition_variable block_cv;
+  bool release = false;
+
+  // Block both threads
+  for (int i = 0; i < 2; i++) {
+    EXPECT_TRUE(pool.enqueue([&]() {
+      std::unique_lock<std::mutex> lock(block_mutex);
+      block_cv.wait(lock, [&] { return release; });
+    }));
+  }
+
+  std::this_thread::sleep_for(std::chrono::milliseconds(100));
+
+  // Fill the queue up to max_queued_requests
+  EXPECT_TRUE(pool.enqueue([]() {}));
+  EXPECT_TRUE(pool.enqueue([]() {}));
+  EXPECT_TRUE(pool.enqueue([]() {}));
+
+  // This should fail - queue is full
+  EXPECT_FALSE(pool.enqueue([]() {}));
+
+  // Release blocked threads
+  {
+    std::unique_lock<std::mutex> lock(block_mutex);
+    release = true;
+  }
+  block_cv.notify_all();
+
+  pool.shutdown();
+}
+
+#ifndef CPPHTTPLIB_NO_EXCEPTIONS
+TEST(ThreadPoolTest, InvalidMaxThreadsThrows) {
+  // max_n < n should throw
+  EXPECT_THROW(ThreadPool(8, 4), std::invalid_argument);
+}
+#endif
+
+TEST(ThreadPoolTest, EnqueueAfterShutdownReturnsFalse) {
+  ThreadPool pool(2);
+  pool.shutdown();
+  EXPECT_FALSE(pool.enqueue([]() {}));
+}
+
+TEST(ThreadPoolTest, ConcurrentEnqueue) {
+  ThreadPool pool(4, 16);
+  std::atomic<int> count(0);
+  const int num_producers = 4;
+  const int tasks_per_producer = 100;
+
+  std::vector<std::thread> producers;
+  for (int p = 0; p < num_producers; p++) {
+    producers.emplace_back([&]() {
+      for (int i = 0; i < tasks_per_producer; i++) {
+        pool.enqueue([&count]() { count++; });
+      }
+    });
+  }
+
+  for (auto &t : producers) {
+    t.join();
+  }
+
+  pool.shutdown();
+  EXPECT_EQ(num_producers * tasks_per_producer, count.load());
+}
@@ -0,0 +1,77 @@
+// Standalone test for WebSocket automatic heartbeat.
+// Compiled with a 1-second ping interval so we can verify heartbeat behavior
+// without waiting 30 seconds.
+
+#define CPPHTTPLIB_WEBSOCKET_PING_INTERVAL_SECOND 1
+#define CPPHTTPLIB_WEBSOCKET_READ_TIMEOUT_SECOND 3
+#include <httplib.h>
+
+#include "gtest/gtest.h"
+
+using namespace httplib;
+
+class WebSocketHeartbeatTest : public ::testing::Test {
+protected:
+  void SetUp() override {
+    svr_.WebSocket("/ws", [](const Request &, ws::WebSocket &ws) {
+      std::string msg;
+      while (ws.read(msg)) {
+        ws.send(msg);
+      }
+    });
+
+    port_ = svr_.bind_to_any_port("localhost");
+    thread_ = std::thread([this]() { svr_.listen_after_bind(); });
+    svr_.wait_until_ready();
+  }
+
+  void TearDown() override {
+    svr_.stop();
+    thread_.join();
+  }
+
+  Server svr_;
+  int port_;
+  std::thread thread_;
+};
+
+// Verify that an idle connection stays alive beyond the read timeout
+// thanks to automatic heartbeat pings.
+TEST_F(WebSocketHeartbeatTest, IdleConnectionStaysAlive) {
+  ws::WebSocketClient client("ws://localhost:" + std::to_string(port_) + "/ws");
+  ASSERT_TRUE(client.connect());
+
+  // Sleep longer than read timeout (3s). Without heartbeat, the connection
+  // would time out. With heartbeat pings every 1s, it stays alive.
+  std::this_thread::sleep_for(std::chrono::seconds(5));
+
+  // Connection should still be open
+  ASSERT_TRUE(client.is_open());
+
+  // Verify we can still exchange messages
+  ASSERT_TRUE(client.send("hello after idle"));
+  std::string msg;
+  ASSERT_TRUE(client.read(msg));
+  EXPECT_EQ("hello after idle", msg);
+
+  client.close();
+}
+
+// Verify that multiple heartbeat cycles work
+TEST_F(WebSocketHeartbeatTest, MultipleHeartbeatCycles) {
+  ws::WebSocketClient client("ws://localhost:" + std::to_string(port_) + "/ws");
+  ASSERT_TRUE(client.connect());
+
+  // Wait through several heartbeat cycles
+  for (int i = 0; i < 3; i++) {
+    std::this_thread::sleep_for(std::chrono::milliseconds(1500));
+    ASSERT_TRUE(client.is_open());
+    std::string text = "msg" + std::to_string(i);
+    ASSERT_TRUE(client.send(text));
+    std::string msg;
+    ASSERT_TRUE(client.read(msg));
+    EXPECT_EQ(text, msg);
+  }
+
+  client.close();
+}