Release v0.38.0

* Remove 32-bit limitation

* Fix build problems

* Add 32-bit disclaimer and fix MSVC x86 warnings

- Move 32-bit warning to top of README with strong disclaimer
- Add static_cast<size_t> to fix truncation warnings on 32-bit MSVC

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/abidiff.yaml

@@ -29,6 +29,7 @@ jobs:
         git
         libbrotli-dev
         libssl-dev
+        libzstd-dev
         meson
         pkg-config
         python3

.github/workflows/docs.yml

@@ -0,0 +1,33 @@
+name: docs
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'docs-src/**'
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Install docs-gen
+        run: cargo install docs-gen
+      - name: Build
+        run: docs-gen build docs-src docs
+      - uses: actions/configure-pages@v5
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/test-32bit.yml

@@ -0,0 +1,36 @@
+name: 32-bit Build Test
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test-win32:
+    name: Windows 32-bit (MSVC x86)
+    runs-on: windows-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build (Win32)
+        shell: cmd
+        run: |
+          call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x86
+          cl /std:c++14 /EHsc /W4 /WX /c /Fo:NUL test\test_32bit_build.cpp
+
+  test-arm32:
+    name: ARM 32-bit (cross-compile)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install cross compiler
+        run: sudo apt-get update && sudo apt-get install -y g++-arm-linux-gnueabihf
+      - name: Build (ARM 32-bit)
+        run: arm-linux-gnueabihf-g++ -std=c++11 -Wall -Wextra -Wno-psabi -Werror -c -o /dev/null test/test_32bit_build.cpp

.github/workflows/test.yaml

@@ -40,7 +40,7 @@ jobs:
           clang-format --version
           cd test && make style_check
 
-  build-error-check-on-32bit:
+  build-and-test-on-32bit:
     runs-on: ubuntu-latest
     if: >
       (github.event_name == 'push') ||
@@ -64,9 +64,8 @@ jobs:
             libssl-dev${{ matrix.config.arch_suffix }} libcurl4-openssl-dev${{ matrix.config.arch_suffix }} \
             zlib1g-dev${{ matrix.config.arch_suffix }} libbrotli-dev${{ matrix.config.arch_suffix }} \
             libzstd-dev${{ matrix.config.arch_suffix }}
-      - name: build and run tests (expect failure)
+      - name: build and run tests
         run: cd test && make test EXTRA_CXXFLAGS="${{ matrix.config.arch_flags }}"
-        continue-on-error: true
 
   ubuntu:
     runs-on: ubuntu-latest
@@ -75,21 +74,45 @@ jobs:
       (github.event_name == 'pull_request'  &&
        github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name) ||
       (github.event_name == 'workflow_dispatch' && github.event.inputs.test_linux == 'true')
+    strategy:
+      matrix:
+        tls_backend: [openssl, mbedtls, wolfssl]
+    name: ubuntu (${{ matrix.tls_backend }})
     steps:
       - name: checkout
         uses: actions/checkout@v4
-      - name: install libraries
+      - name: install common libraries
         run: |
-          sudo dpkg --add-architecture i386
           sudo apt-get update
-          sudo apt-get install -y libc6-dev${{ matrix.config.arch_suffix }} libstdc++-13-dev${{ matrix.config.arch_suffix }} \
-            libssl-dev${{ matrix.config.arch_suffix }} libcurl4-openssl-dev${{ matrix.config.arch_suffix }} \
-            zlib1g-dev${{ matrix.config.arch_suffix }} libbrotli-dev${{ matrix.config.arch_suffix }} \
-            libzstd-dev${{ matrix.config.arch_suffix }}
-      - name: build and run tests
-        run: cd test && make EXTRA_CXXFLAGS="${{ matrix.config.arch_flags }}"
+          sudo apt-get install -y libcurl4-openssl-dev zlib1g-dev libbrotli-dev libzstd-dev
+      - name: install OpenSSL
+        if: matrix.tls_backend == 'openssl'
+        run: sudo apt-get install -y libssl-dev
+      - name: install Mbed TLS
+        if: matrix.tls_backend == 'mbedtls'
+        run: sudo apt-get install -y libmbedtls-dev
+      - name: install wolfSSL
+        if: matrix.tls_backend == 'wolfssl'
+        run: sudo apt-get install -y libwolfssl-dev
+      - name: build and run tests (OpenSSL)
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_split && make test_openssl_parallel
+        env:
+          LSAN_OPTIONS: suppressions=lsan_suppressions.txt
+      - name: build and run tests (Mbed TLS)
+        if: matrix.tls_backend == 'mbedtls'
+        run: cd test && make test_split_mbedtls && make test_mbedtls_parallel
+      - name: build and run tests (wolfSSL)
+        if: matrix.tls_backend == 'wolfssl'
+        run: cd test && make test_split_wolfssl && make test_wolfssl_parallel
       - name: run fuzz test target
-        run: cd test && make EXTRA_CXXFLAGS="${{ matrix.config.arch_flags }}" fuzz_test
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make fuzz_test
+      - name: build and run WebSocket heartbeat test
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_websocket_heartbeat && ./test_websocket_heartbeat
+      - name: build and run ThreadPool test
+        run: cd test && make test_thread_pool && ./test_thread_pool
 
   macos:
     runs-on: macos-latest
@@ -98,13 +121,38 @@ jobs:
       (github.event_name == 'pull_request'  &&
        github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name) ||
       (github.event_name == 'workflow_dispatch' && github.event.inputs.test_macos == 'true')
+    strategy:
+      matrix:
+        tls_backend: [openssl, mbedtls, wolfssl]
+    name: macos (${{ matrix.tls_backend }})
     steps:
       - name: checkout
         uses: actions/checkout@v4
-      - name: build and run tests
-        run: cd test && make
+      - name: install Mbed TLS
+        if: matrix.tls_backend == 'mbedtls'
+        run: brew install mbedtls@3
+      - name: install wolfSSL
+        if: matrix.tls_backend == 'wolfssl'
+        run: brew install wolfssl
+      - name: build and run tests (OpenSSL)
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_split && make test_openssl_parallel
+        env:
+          LSAN_OPTIONS: suppressions=lsan_suppressions.txt
+      - name: build and run tests (Mbed TLS)
+        if: matrix.tls_backend == 'mbedtls'
+        run: cd test && make test_split_mbedtls && make test_mbedtls_parallel
+      - name: build and run tests (wolfSSL)
+        if: matrix.tls_backend == 'wolfssl'
+        run: cd test && make test_split_wolfssl && make test_wolfssl_parallel
       - name: run fuzz test target
+        if: matrix.tls_backend == 'openssl'
         run: cd test && make fuzz_test
+      - name: build and run WebSocket heartbeat test
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_websocket_heartbeat && ./test_websocket_heartbeat
+      - name: build and run ThreadPool test
+        run: cd test && make test_thread_pool && ./test_thread_pool
 
   windows:
     runs-on: windows-latest
@@ -144,7 +192,14 @@ jobs:
           core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
     - name: Setup msbuild on windows
       uses: microsoft/setup-msbuild@v2
+    - name: Cache vcpkg packages
+      id: vcpkg-cache
+      uses: actions/cache@v4
+      with:
+        path: C:/vcpkg/installed
+        key: vcpkg-installed-windows-gtest-curl-zlib-brotli-zstd
     - name: Install vcpkg dependencies
+      if: steps.vcpkg-cache.outputs.cache-hit != 'true'
       run: vcpkg install gtest curl zlib brotli zstd
     - name: Install OpenSSL
       if: ${{ matrix.config.with_ssl }}
@@ -156,6 +211,7 @@ jobs:
         -DCMAKE_TOOLCHAIN_FILE=${{ env.VCPKG_ROOT }}/scripts/buildsystems/vcpkg.cmake
         -DHTTPLIB_TEST=ON
         -DHTTPLIB_COMPILE=${{ matrix.config.compiled && 'ON' || 'OFF' }}
+        -DHTTPLIB_USE_OPENSSL_IF_AVAILABLE=${{ matrix.config.with_ssl && 'ON' || 'OFF' }}
         -DHTTPLIB_REQUIRE_ZLIB=ON
         -DHTTPLIB_REQUIRE_BROTLI=ON
         -DHTTPLIB_REQUIRE_ZSTD=ON
@@ -164,7 +220,34 @@ jobs:
       run: cmake --build build --config Release -- /v:m /clp:ShowCommandLine
     - name: Run tests ${{ matrix.config.name }}
       if: ${{ matrix.config.run_tests }}
-      run: ctest --output-on-failure --test-dir build -C Release
+      shell: pwsh
+      working-directory: build/test
+      run: |
+        $shards = 4
+        $procs = @()
+        for ($i = 0; $i -lt $shards; $i++) {
+          $log = "shard_${i}.log"
+          $procs += Start-Process -FilePath ./Release/httplib-test.exe `
+            -ArgumentList "--gtest_color=yes","--gtest_filter=${{ github.event.inputs.gtest_filter || '*' }}" `
+            -NoNewWindow -PassThru -RedirectStandardOutput $log -RedirectStandardError "${log}.err" `
+            -Environment @{ GTEST_TOTAL_SHARDS="$shards"; GTEST_SHARD_INDEX="$i" }
+        }
+        $procs | Wait-Process
+        $failed = $false
+        for ($i = 0; $i -lt $shards; $i++) {
+          $log = "shard_${i}.log"
+          if (Select-String -Path $log -Pattern "\[  PASSED  \]" -Quiet) {
+            $passed = (Select-String -Path $log -Pattern "\[  PASSED  \]").Line
+            Write-Host "Shard ${i}: $passed"
+          } else {
+            Write-Host "=== Shard $i FAILED ==="
+            Get-Content $log
+            if (Test-Path "${log}.err") { Get-Content "${log}.err" }
+            $failed = $true
+          }
+        }
+        if ($failed) { exit 1 }
+        Write-Host "All shards passed."
 
     env:
       VCPKG_ROOT: "C:/vcpkg"

.github/workflows/test_benchmark.yaml

@@ -0,0 +1,79 @@
+name: benchmark
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  ubuntu:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: build and run
+        run: cd test && make test_benchmark && ./test_benchmark
+
+  macos:
+    runs-on: macos-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: build and run
+        run: cd test && make test_benchmark && ./test_benchmark
+
+  windows:
+    runs-on: windows-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+    steps:
+      - name: Prepare Git for Checkout on Windows
+        run: |
+          git config --global core.autocrlf false
+          git config --global core.eol lf
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Export GitHub Actions cache environment variables
+        uses: actions/github-script@v7
+        with:
+          script: |
+            core.exportVariable('ACTIONS_CACHE_URL', process.env.ACTIONS_CACHE_URL || '');
+            core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
+      - name: Cache vcpkg packages
+        id: vcpkg-cache
+        uses: actions/cache@v4
+        with:
+          path: C:/vcpkg/installed
+          key: vcpkg-installed-windows-gtest
+      - name: Install vcpkg dependencies
+        if: steps.vcpkg-cache.outputs.cache-hit != 'true'
+        run: vcpkg install gtest
+      - name: Configure and build
+        shell: pwsh
+        run: |
+          $cmake_content = @"
+          cmake_minimum_required(VERSION 3.14)
+          project(httplib-benchmark CXX)
+          find_package(GTest REQUIRED)
+          add_executable(httplib-benchmark test/test_benchmark.cc)
+          target_include_directories(httplib-benchmark PRIVATE .)
+          target_link_libraries(httplib-benchmark PRIVATE GTest::gtest_main)
+          target_compile_options(httplib-benchmark PRIVATE "$<$<CXX_COMPILER_ID:MSVC>:/utf-8>")
+          "@
+          New-Item -ItemType Directory -Force -Path build_bench/test | Out-Null
+          Set-Content -Path build_bench/CMakeLists.txt -Value $cmake_content
+          Copy-Item -Path httplib.h -Destination build_bench/
+          Copy-Item -Path test/test_benchmark.cc -Destination build_bench/test/
+          cmake -B build_bench/build -S build_bench `
+            -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake"
+          cmake --build build_bench/build --config Release
+      - name: Run with retry
+        run: ctest --output-on-failure --test-dir build_bench/build -C Release --repeat until-pass:5
+    env:
+      VCPKG_ROOT: "C:/vcpkg"
+      VCPKG_BINARY_SOURCES: "clear;x-gha,readwrite"

.github/workflows/test_no_exceptions.yaml

@@ -0,0 +1,20 @@
+name: No Exceptions Test
+
+on: [push, pull_request]
+
+jobs:
+  test-no-exceptions:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Install dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y build-essential libssl-dev zlib1g-dev libcurl4-openssl-dev libbrotli-dev libzstd-dev
+
+    - name: Run tests with CPPHTTPLIB_NO_EXCEPTIONS
+      run: |
+        cd test && make test_split EXTRA_CXXFLAGS="-fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS" && make test_openssl_parallel EXTRA_CXXFLAGS="-fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS"

.github/workflows/test_offline.yaml

@@ -0,0 +1,62 @@
+name: test_offline
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      test_linux:
+        description: 'Test on Linux'
+        type: boolean
+        default: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  GTEST_FILTER: "-*.*_Online"
+
+jobs:
+  ubuntu:
+    runs-on: ubuntu-latest
+    if: >
+      (github.event_name == 'push') ||
+      (github.event_name == 'pull_request'  &&
+       github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name) ||
+      (github.event_name == 'workflow_dispatch' && github.event.inputs.test_linux == 'true')
+    strategy:
+      matrix:
+        tls_backend: [openssl, no-tls]
+    name: ubuntu (${{ matrix.tls_backend }})
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: install common libraries
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libcurl4-openssl-dev zlib1g-dev libbrotli-dev libzstd-dev
+      - name: install OpenSSL
+        if: matrix.tls_backend == 'openssl'
+        run: sudo apt-get install -y libssl-dev
+      - name: disable network
+        run: |
+          sudo iptables -A OUTPUT -o lo -j ACCEPT
+          sudo iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+          sudo iptables -A OUTPUT -j REJECT
+          sudo ip6tables -A OUTPUT -o lo -j ACCEPT
+          sudo ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+          sudo ip6tables -A OUTPUT -j REJECT
+      - name: build and run tests (OpenSSL)
+        if: matrix.tls_backend == 'openssl'
+        run: cd test && make test_split && make test_openssl_parallel
+        env:
+          LSAN_OPTIONS: suppressions=lsan_suppressions.txt
+      - name: build and run tests (No TLS)
+        if: matrix.tls_backend == 'no-tls'
+        run: cd test && make test_no_tls_parallel
+      - name: restore network
+        if: always()
+        run: |
+          sudo iptables -F OUTPUT
+          sudo ip6tables -F OUTPUT

.github/workflows/test_proxy.yaml

@@ -6,15 +6,32 @@ jobs:
   test-proxy:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
-    
+    strategy:
+      matrix:
+        tls_backend: [openssl, mbedtls]
+    name: proxy (${{ matrix.tls_backend }})
+
     steps:
-    - uses: actions/checkout@v3
-    
-    - name: Install dependencies
+    - uses: actions/checkout@v4
+
+    - name: Install common dependencies
       run: |
         sudo apt-get update
-        sudo apt-get install -y build-essential libssl-dev zlib1g-dev libcurl4-openssl-dev libbrotli-dev libzstd-dev netcat-openbsd
-        
-    - name: Run proxy tests
-      run: |
-        cd test && make proxy
+        sudo apt-get install -y build-essential zlib1g-dev libcurl4-openssl-dev libbrotli-dev libzstd-dev netcat-openbsd
+    - name: Install OpenSSL
+      if: matrix.tls_backend == 'openssl'
+      run: sudo apt-get install -y libssl-dev
+    - name: Install Mbed TLS
+      if: matrix.tls_backend == 'mbedtls'
+      run: sudo apt-get install -y libmbedtls-dev
+
+    - name: Run proxy tests (OpenSSL)
+      if: matrix.tls_backend == 'openssl'
+      run: cd test && make proxy
+      env:
+        COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
+    - name: Run proxy tests (Mbed TLS)
+      if: matrix.tls_backend == 'mbedtls'
+      run: cd test && make proxy_mbedtls
+      env:
+        COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml

.gitignore

@@ -1,4 +1,7 @@
 tags
+AGENTS.md
+docs-src/pages/AGENTS.md
+plans/
 
 # Ignore executables (no extension) but not source files
 example/server
@@ -16,28 +19,49 @@ example/benchmark
 example/redirect
 !example/redirect.*
 example/ssecli
+!example/ssecli.*
+example/ssecli-stream
+!example/ssecli-stream.*
 example/ssesvr
+!example/ssesvr.*
 example/upload
 !example/upload.*
 example/one_time_request
 !example/one_time_request.*
 example/server_and_client
 !example/server_and_client.*
+example/accept_header
+!example/accept_header.*
+example/wsecho
+!example/wsecho.*
 example/*.pem
 test/httplib.cc
 test/httplib.h
 test/test
+test/test_mbedtls
+test/test_wolfssl
+test/test_no_tls
 test/server_fuzzer
 test/test_proxy
+test/test_proxy_mbedtls
+test/test_proxy_wolfssl
 test/test_split
+test/test_split_mbedtls
+test/test_split_wolfssl
+test/test_split_no_tls
+test/test_websocket_heartbeat
+test/test_thread_pool
+test/test_benchmark
 test/test.xcodeproj/xcuser*
 test/test.xcodeproj/*/xcuser*
 test/*.o
 test/*.pem
 test/*.srl
+test/*.log
 test/_build_*
 work/
 benchmark/server*
+docs-gen/target/
 
 *.swp
 

CMakeLists.txt

@@ -1,25 +1,31 @@
 #[[
 	Build options:
-	* BUILD_SHARED_LIBS (default off) builds as a shared library (if HTTPLIB_COMPILE is ON)
+	* Standard BUILD_SHARED_LIBS is supported and sets HTTPLIB_SHARED default value.
 	* HTTPLIB_USE_OPENSSL_IF_AVAILABLE (default on)
+	* HTTPLIB_USE_WOLFSSL_IF_AVAILABLE (default off)
+	* HTTPLIB_USE_MBEDTLS_IF_AVAILABLE (default off)
 	* HTTPLIB_USE_ZLIB_IF_AVAILABLE (default on)
 	* HTTPLIB_USE_BROTLI_IF_AVAILABLE (default on)
 	* HTTPLIB_USE_ZSTD_IF_AVAILABLE (default on)
+	* HTTPLIB_BUILD_MODULES (default off)
 	* HTTPLIB_REQUIRE_OPENSSL (default off)
+	* HTTPLIB_REQUIRE_WOLFSSL (default off)
+	* HTTPLIB_REQUIRE_MBEDTLS (default off)
 	* HTTPLIB_REQUIRE_ZLIB (default off)
 	* HTTPLIB_REQUIRE_BROTLI (default off)
 	* HTTPLIB_REQUIRE_ZSTD (default off)
-	* HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN (default on)
+	* HTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES (default off)
 	* HTTPLIB_USE_NON_BLOCKING_GETADDRINFO (default on)
 	* HTTPLIB_COMPILE (default off)
 	* HTTPLIB_INSTALL (default on)
+	* HTTPLIB_SHARED (default off) builds as a shared library (if HTTPLIB_COMPILE is ON)
 	* HTTPLIB_TEST (default off)
 	* BROTLI_USE_STATIC_LIBS - tells Cmake to use the static Brotli libs (only works if you have them installed).
 	* OPENSSL_USE_STATIC_LIBS - tells Cmake to use the static OpenSSL libs (only works if you have them installed).
 
 	-------------------------------------------------------------------------------
 
-	After installation with Cmake, a find_package(httplib COMPONENTS OpenSSL ZLIB Brotli zstd) is available.
+	After installation with Cmake, a find_package(httplib COMPONENTS OpenSSL wolfssl MbedTLS ZLIB Brotli zstd) is available.
 	This creates a httplib::httplib target (if found and if listed components are supported).
 	It can be linked like so:
 
@@ -46,10 +52,12 @@
 	These variables are available after you run find_package(httplib)
 	* HTTPLIB_HEADER_PATH - this is the full path to the installed header (e.g. /usr/include/httplib.h).
 	* HTTPLIB_IS_USING_OPENSSL - a bool for if OpenSSL support is enabled.
+	* HTTPLIB_IS_USING_WOLFSSL - a bool for if wolfSSL support is enabled.
+	* HTTPLIB_IS_USING_MBEDTLS - a bool for if MbedTLS support is enabled.
 	* HTTPLIB_IS_USING_ZLIB - a bool for if ZLIB support is enabled.
 	* HTTPLIB_IS_USING_BROTLI - a bool for if Brotli support is enabled.
 	* HTTPLIB_IS_USING_ZSTD - a bool for if ZSTD support is enabled.
-	* HTTPLIB_IS_USING_CERTS_FROM_MACOSX_KEYCHAIN - a bool for if support of loading system certs from the Apple Keychain is enabled.
+	* HTTPLIB_IS_USING_MACOSX_AUTOMATIC_ROOT_CERTIFICATES - a bool for if support of loading system certs from the Apple Keychain is enabled.
 	* HTTPLIB_IS_USING_NON_BLOCKING_GETADDRINFO - a bool for if nonblocking getaddrinfo is enabled.
 	* HTTPLIB_IS_COMPILED - a bool for if the library is compiled, or otherwise header-only.
 	* HTTPLIB_INCLUDE_DIR - the root path to httplib's header (e.g. /usr/include).
@@ -93,10 +101,14 @@ set(_HTTPLIB_OPENSSL_MIN_VER "3.0.0")
 option(HTTPLIB_NO_EXCEPTIONS "Disable the use of C++ exceptions" OFF)
 # Allow for a build to require OpenSSL to pass, instead of just being optional
 option(HTTPLIB_REQUIRE_OPENSSL "Requires OpenSSL to be found & linked, or fails build." OFF)
+option(HTTPLIB_REQUIRE_WOLFSSL "Requires wolfSSL to be found & linked, or fails build." OFF)
+option(HTTPLIB_REQUIRE_MBEDTLS "Requires MbedTLS to be found & linked, or fails build." OFF)
 option(HTTPLIB_REQUIRE_ZLIB "Requires ZLIB to be found & linked, or fails build." OFF)
 # Allow for a build to casually enable OpenSSL/ZLIB support, but silently continue if not found.
 # Make these options so their automatic use can be specifically disabled (as needed)
 option(HTTPLIB_USE_OPENSSL_IF_AVAILABLE "Uses OpenSSL (if available) to enable HTTPS support." ON)
+option(HTTPLIB_USE_WOLFSSL_IF_AVAILABLE "Uses wolfSSL (if available) to enable HTTPS support." OFF)
+option(HTTPLIB_USE_MBEDTLS_IF_AVAILABLE "Uses MbedTLS (if available) to enable HTTPS support." OFF)
 option(HTTPLIB_USE_ZLIB_IF_AVAILABLE "Uses ZLIB (if available) to enable Zlib compression support." ON)
 # Lets you compile the program as a regular library instead of header-only
 option(HTTPLIB_COMPILE "If ON, uses a Python script to split the header into a compilable header & source file (requires Python v3)." OFF)
@@ -105,35 +117,69 @@ option(HTTPLIB_INSTALL "Enables the installation target" ON)
 option(HTTPLIB_TEST "Enables testing and builds tests" OFF)
 option(HTTPLIB_REQUIRE_BROTLI "Requires Brotli to be found & linked, or fails build." OFF)
 option(HTTPLIB_USE_BROTLI_IF_AVAILABLE "Uses Brotli (if available) to enable Brotli decompression support." ON)
-option(HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN "Enable feature to load system certs from the Apple Keychain." ON)
+option(HTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES "Disable loading system certs from the Apple Keychain on macOS." OFF)
 option(HTTPLIB_USE_NON_BLOCKING_GETADDRINFO "Enables the non-blocking alternatives for getaddrinfo." ON)
 option(HTTPLIB_REQUIRE_ZSTD "Requires ZSTD to be found & linked, or fails build." OFF)
 option(HTTPLIB_USE_ZSTD_IF_AVAILABLE "Uses ZSTD (if available) to enable zstd support." ON)
-# Defaults to static library
-option(BUILD_SHARED_LIBS "Build the library as a shared library instead of static. Has no effect if using header-only." OFF)
-if(BUILD_SHARED_LIBS AND WIN32 AND HTTPLIB_COMPILE)
-	# Necessary for Windows if building shared libs
-	# See https://stackoverflow.com/a/40743080
-	set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS ON)
+# C++20 modules support requires CMake 3.28 or later
+if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.28")
+	option(HTTPLIB_BUILD_MODULES "Build httplib modules (requires HTTPLIB_COMPILE to be ON)." OFF)
+else()
+	set(HTTPLIB_BUILD_MODULES OFF CACHE INTERNAL "Build httplib modules disabled (requires CMake 3.28+)" FORCE)
+	if(DEFINED CACHE{HTTPLIB_BUILD_MODULES} AND HTTPLIB_BUILD_MODULES)
+		message(WARNING "HTTPLIB_BUILD_MODULES requires CMake 3.28 or later. Current version is ${CMAKE_VERSION}. Modules support has been disabled.")
+	endif()
+endif()
+
+# Incompatibility between TLS libraries
+set(TLS_LIBRARIES_USED_TMP 0)
+
+foreach(tls_library OPENSSL WOLFSSL MBEDTLS)
+	set(TLS_REQUIRED ${HTTPLIB_REQUIRE_${tls_library}})
+	set(TLS_IF_AVAILABLE ${HTTPLIB_USE_${tls_library}_IF_AVAILABLE})
+
+	if(TLS_REQUIRED OR TLS_IF_AVAILABLE)
+		math(EXPR TLS_LIBRARIES_USED_TMP "${TLS_LIBRARIES_USED_TMP} + 1")
+	endif()
+endforeach()
+
+if(TLS_LIBRARIES_USED_TMP GREATER 1)
+	message(FATAL_ERROR "TLS libraries are mutually exclusive.")
+endif()
+
+# Defaults to static library but respects standard BUILD_SHARED_LIBS if set
+include(CMakeDependentOption)
+cmake_dependent_option(HTTPLIB_SHARED "Build the library as a shared library instead of static. Has no effect if using header-only."
+	"${BUILD_SHARED_LIBS}" HTTPLIB_COMPILE OFF
+)
+if(HTTPLIB_SHARED)
+	set(HTTPLIB_LIB_TYPE SHARED)
+	if(WIN32)
+		# Necessary for Windows if building shared libs
+		# See https://stackoverflow.com/a/40743080
+		set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS ON)
+	endif()
+else()
+	set(HTTPLIB_LIB_TYPE STATIC)
 endif()
 
 if(CMAKE_SYSTEM_NAME MATCHES "Windows")
 	if(CMAKE_SYSTEM_VERSION)
 		if(${CMAKE_SYSTEM_VERSION} VERSION_LESS "10.0.0")
-			message(SEND_ERROR "Windows ${CMAKE_SYSTEM_VERSION} or lower is not supported. Please use Windows 10 or later.")
+			message(WARNING "Windows ${CMAKE_SYSTEM_VERSION} or lower is not supported. Please use Windows 10 or later.")
 		endif()
 	else()
 		set(CMAKE_SYSTEM_VERSION "10.0.19041.0")
 		message(WARNING "The target is Windows but CMAKE_SYSTEM_VERSION is not set, the default system version is set to Windows 10.")
 	endif()
 endif()
-if(CMAKE_SIZEOF_VOID_P LESS 8)
-	message(WARNING "Pointer size ${CMAKE_SIZEOF_VOID_P} is not supported. Please use a 64-bit compiler.")
-endif()
 
 # Set some variables that are used in-tree and while building based on our options
 set(HTTPLIB_IS_COMPILED ${HTTPLIB_COMPILE})
-set(HTTPLIB_IS_USING_CERTS_FROM_MACOSX_KEYCHAIN ${HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN})
+set(HTTPLIB_IS_USING_MACOSX_AUTOMATIC_ROOT_CERTIFICATES TRUE)
+if(HTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES)
+	set(HTTPLIB_IS_USING_MACOSX_AUTOMATIC_ROOT_CERTIFICATES FALSE)
+endif()
 set(HTTPLIB_IS_USING_NON_BLOCKING_GETADDRINFO ${HTTPLIB_USE_NON_BLOCKING_GETADDRINFO})
 
 # Threads needed for <thread> on some systems, and for <pthread.h> on Linux
@@ -154,6 +200,22 @@ elseif(HTTPLIB_USE_OPENSSL_IF_AVAILABLE)
 	endif()
 endif()
 
+if(HTTPLIB_REQUIRE_WOLFSSL)
+	find_package(wolfssl REQUIRED)
+	set(HTTPLIB_IS_USING_WOLFSSL TRUE)
+elseif(HTTPLIB_USE_WOLFSSL_IF_AVAILABLE)
+	find_package(wolfssl QUIET)
+	set(HTTPLIB_IS_USING_WOLFSSL ${wolfssl_FOUND})
+endif()
+
+if(HTTPLIB_REQUIRE_MBEDTLS)
+	find_package(MbedTLS REQUIRED)
+	set(HTTPLIB_IS_USING_MBEDTLS TRUE)
+elseif(HTTPLIB_USE_MBEDTLS_IF_AVAILABLE)
+	find_package(MbedTLS QUIET)
+	set(HTTPLIB_IS_USING_MBEDTLS ${MbedTLS_FOUND})
+endif()
+
 if(HTTPLIB_REQUIRE_ZLIB)
 	find_package(ZLIB REQUIRED)
 	set(HTTPLIB_IS_USING_ZLIB TRUE)
@@ -176,8 +238,11 @@ elseif(HTTPLIB_USE_BROTLI_IF_AVAILABLE)
 	set(HTTPLIB_IS_USING_BROTLI ${Brotli_FOUND})
 endif()
 
+# NOTE:
+# zstd < 1.5.6 does not provide the CMake imported target `zstd::libzstd`.
+# Older versions must be consumed via their pkg-config file.
 if(HTTPLIB_REQUIRE_ZSTD)
-	find_package(zstd)
+	find_package(zstd 1.5.6 CONFIG)
 	if(NOT zstd_FOUND)
 		find_package(PkgConfig REQUIRED)
 		pkg_check_modules(zstd REQUIRED IMPORTED_TARGET libzstd)
@@ -185,7 +250,7 @@ if(HTTPLIB_REQUIRE_ZSTD)
 	endif()
 	set(HTTPLIB_IS_USING_ZSTD TRUE)
 elseif(HTTPLIB_USE_ZSTD_IF_AVAILABLE)
-	find_package(zstd QUIET)
+	find_package(zstd 1.5.6 CONFIG QUIET)
 	if(NOT zstd_FOUND)
 		find_package(PkgConfig QUIET)
 		if(PKG_CONFIG_FOUND)
@@ -228,15 +293,37 @@ if(HTTPLIB_COMPILE)
 		message(FATAL_ERROR "Failed when trying to split cpp-httplib with the Python script.\n${_httplib_split_error}")
 	endif()
 
+	# If building modules, also generate the module file
+	if(HTTPLIB_BUILD_MODULES)
+		# Put the generate_module script into the build dir
+		configure_file(generate_module.py "${CMAKE_CURRENT_BINARY_DIR}/generate_module.py"
+			COPYONLY
+		)
+		# Generate the module file
+		execute_process(COMMAND ${Python3_EXECUTABLE} "${CMAKE_CURRENT_BINARY_DIR}/generate_module.py"
+			WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+			ERROR_VARIABLE _httplib_module_error
+		)
+		if(_httplib_module_error)
+			message(FATAL_ERROR "Failed when trying to generate cpp-httplib module with the Python script.\n${_httplib_module_error}")
+		endif()
+	endif()
+
 	# split.py puts output in "out"
 	set(_httplib_build_includedir "${CMAKE_CURRENT_BINARY_DIR}/out")
-	# This will automatically be either static or shared based on the value of BUILD_SHARED_LIBS
-	add_library(${PROJECT_NAME} "${_httplib_build_includedir}/httplib.cc")
+	add_library(${PROJECT_NAME} ${HTTPLIB_LIB_TYPE} "${_httplib_build_includedir}/httplib.cc")
 	target_sources(${PROJECT_NAME}
 		PUBLIC
 			$<BUILD_INTERFACE:${_httplib_build_includedir}/httplib.h>
 			$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}/httplib.h>
 	)
+	
+	# Add C++20 module support if requested
+	# Include from separate file to prevent parse errors on older CMake versions
+	if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.28")
+		include(cmake/modules.cmake)
+	endif()
+	
 	set_target_properties(${PROJECT_NAME}
 		PROPERTIES
 			VERSION ${${PROJECT_NAME}_VERSION}
@@ -253,22 +340,28 @@ endif()
 # Only useful if building in-tree, versus using it from an installation.
 add_library(${PROJECT_NAME}::${PROJECT_NAME} ALIAS ${PROJECT_NAME})
 
-# Require C++11
-target_compile_features(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC} cxx_std_11)
+# Require C++11, or C++20 if modules are enabled
+if(HTTPLIB_BUILD_MODULES)
+	target_compile_features(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC} cxx_std_20)
+else()
+	target_compile_features(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC} cxx_std_11)
+endif()
 
 target_include_directories(${PROJECT_NAME} SYSTEM ${_INTERFACE_OR_PUBLIC}
 	$<BUILD_INTERFACE:${_httplib_build_includedir}>
 	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
 )
 
-# Always require threads
 target_link_libraries(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC}
+		# Always require threads
 		Threads::Threads
 		# Needed for Windows libs on Mingw, as the pragma comment(lib, "xyz") aren't triggered.
 		$<$<PLATFORM_ID:Windows>:ws2_32>
 		$<$<PLATFORM_ID:Windows>:crypt32>
 		# Needed for API from MacOS Security framework
-		"$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>,$<BOOL:${HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN}>>:-framework CoreFoundation -framework Security>"
+		"$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>,$<BOOL:${HTTPLIB_IS_USING_MACOSX_AUTOMATIC_ROOT_CERTIFICATES}>>:-framework CFNetwork -framework CoreFoundation -framework Security>"
+		# Needed for non-blocking getaddrinfo on MacOS
+		"$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_USE_NON_BLOCKING_GETADDRINFO}>>:-framework CFNetwork -framework CoreFoundation>"
 		# Can't put multiple targets in a single generator expression or it bugs out.
 		$<$<BOOL:${HTTPLIB_IS_USING_BROTLI}>:Brotli::common>
 		$<$<BOOL:${HTTPLIB_IS_USING_BROTLI}>:Brotli::encoder>
@@ -277,6 +370,8 @@ target_link_libraries(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC}
 		$<$<BOOL:${HTTPLIB_IS_USING_ZSTD}>:zstd::libzstd>
 		$<$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>:OpenSSL::SSL>
 		$<$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>:OpenSSL::Crypto>
+		$<$<BOOL:${HTTPLIB_IS_USING_WOLFSSL}>:wolfssl::wolfssl>
+		$<$<BOOL:${HTTPLIB_IS_USING_MBEDTLS}>:MbedTLS::mbedtls>
 )
 
 # Set the definitions to enable optional features
@@ -286,7 +381,9 @@ target_compile_definitions(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC}
 	$<$<BOOL:${HTTPLIB_IS_USING_ZLIB}>:CPPHTTPLIB_ZLIB_SUPPORT>
 	$<$<BOOL:${HTTPLIB_IS_USING_ZSTD}>:CPPHTTPLIB_ZSTD_SUPPORT>
 	$<$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>:CPPHTTPLIB_OPENSSL_SUPPORT>
-	$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>,$<BOOL:${HTTPLIB_IS_USING_CERTS_FROM_MACOSX_KEYCHAIN}>>:CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN>
+	$<$<BOOL:${HTTPLIB_IS_USING_WOLFSSL}>:CPPHTTPLIB_WOLFSSL_SUPPORT>
+	$<$<BOOL:${HTTPLIB_IS_USING_MBEDTLS}>:CPPHTTPLIB_MBEDTLS_SUPPORT>
+	$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES}>>:CPPHTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES>
 	$<$<BOOL:${HTTPLIB_USE_NON_BLOCKING_GETADDRINFO}>:CPPHTTPLIB_USE_NON_BLOCKING_GETADDRINFO>
 )
 
@@ -324,7 +421,11 @@ if(HTTPLIB_INSTALL)
 	# Creates the export httplibTargets.cmake
 	# This is strictly what holds compilation requirements
 	# and linkage information (doesn't find deps though).
-	install(TARGETS ${PROJECT_NAME} EXPORT httplibTargets)
+	if(HTTPLIB_BUILD_MODULES)
+		install(TARGETS ${PROJECT_NAME} EXPORT httplibTargets FILE_SET CXX_MODULES DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/httplib/modules CXX_MODULES_BMI DESTINATION ${CMAKE_INSTALL_LIBDIR}/httplib/modules)
+	else()
+		install(TARGETS ${PROJECT_NAME} EXPORT httplibTargets)
+	endif()
 
 	install(FILES "${_httplib_build_includedir}/httplib.h" TYPE INCLUDE)
 
@@ -353,6 +454,10 @@ if(HTTPLIB_INSTALL)
 	include(CPack)
 endif()
 
+if(HTTPLIB_BUILD_MODULES AND NOT HTTPLIB_COMPILE)
+	message(FATAL_ERROR "HTTPLIB_BUILD_MODULES requires HTTPLIB_COMPILE to be ON.")
+endif()
+
 if(HTTPLIB_TEST)
 	include(CTest)
 	add_subdirectory(test)

README-sse.md

@@ -0,0 +1,182 @@
+# SSEClient - Server-Sent Events Client
+
+A simple, EventSource-like SSE client for C++11.
+
+## Features
+
+- **Auto-reconnect**: Automatically reconnects on connection loss
+- **Last-Event-ID**: Sends last received ID on reconnect for resumption
+- **retry field**: Respects server's reconnect interval
+- **Event types**: Supports custom event types via `on_event()`
+- **Async support**: Run in background thread with `start_async()`
+- **C++11 compatible**: No C++14/17/20 features required
+
+## Quick Start
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << "Event: " << msg.event << std::endl;
+    std::cout << "Data: " << msg.data << std::endl;
+});
+
+sse.start();  // Blocking, with auto-reconnect
+```
+
+## API Reference
+
+### SSEMessage
+
+```cpp
+struct SSEMessage {
+    std::string event;  // Event type (default: "message")
+    std::string data;   // Event payload
+    std::string id;     // Event ID
+};
+```
+
+### SSEClient
+
+#### Constructor
+
+```cpp
+// Basic
+SSEClient(Client &client, const std::string &path);
+
+// With custom headers
+SSEClient(Client &client, const std::string &path, const Headers &headers);
+```
+
+#### Event Handlers
+
+```cpp
+// Called for all events (or events without a specific handler)
+sse.on_message([](const SSEMessage &msg) { });
+
+// Called for specific event types
+sse.on_event("update", [](const SSEMessage &msg) { });
+sse.on_event("delete", [](const SSEMessage &msg) { });
+
+// Called when connection is established
+sse.on_open([]() { });
+
+// Called on connection errors
+sse.on_error([](httplib::Error err) { });
+```
+
+#### Configuration
+
+```cpp
+// Set reconnect interval (default: 3000ms)
+sse.set_reconnect_interval(5000);
+
+// Set max reconnect attempts (default: 0 = unlimited)
+sse.set_max_reconnect_attempts(10);
+```
+
+#### Control
+
+```cpp
+// Blocking start with auto-reconnect
+sse.start();
+
+// Non-blocking start (runs in background thread)
+sse.start_async();
+
+// Stop the client (thread-safe)
+sse.stop();
+```
+
+#### State
+
+```cpp
+bool connected = sse.is_connected();
+const std::string &id = sse.last_event_id();
+```
+
+## Examples
+
+### Basic Usage
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << msg.data << std::endl;
+});
+
+sse.start();
+```
+
+### With Custom Event Types
+
+```cpp
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_event("notification", [](const httplib::sse::SSEMessage &msg) {
+    std::cout << "Notification: " << msg.data << std::endl;
+});
+
+sse.on_event("update", [](const httplib::sse::SSEMessage &msg) {
+    std::cout << "Update: " << msg.data << std::endl;
+});
+
+sse.start();
+```
+
+### Async with Stop
+
+```cpp
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << msg.data << std::endl;
+});
+
+sse.start_async();  // Returns immediately
+
+// ... do other work ...
+
+sse.stop();  // Stop when done
+```
+
+### With Custom Headers (e.g., Authentication)
+
+```cpp
+httplib::Headers headers = {
+    {"Authorization", "Bearer token123"}
+};
+
+httplib::sse::SSEClient sse(cli, "/events", headers);
+sse.start();
+```
+
+### Error Handling
+
+```cpp
+sse.on_error([](httplib::Error err) {
+    std::cerr << "Error: " << httplib::to_string(err) << std::endl;
+});
+
+sse.set_reconnect_interval(1000);
+sse.set_max_reconnect_attempts(5);
+
+sse.start();
+```
+
+## SSE Protocol
+
+The client parses SSE format according to the [W3C specification](https://html.spec.whatwg.org/multipage/server-sent-events.html):
+
+```
+event: custom-type
+id: 123
+data: {"message": "hello"}
+
+data: simple message
+
+: this is a comment (ignored)
+```

README-stream.md

@@ -0,0 +1,317 @@
+# cpp-httplib Streaming API
+
+This document describes the streaming extensions for cpp-httplib, providing an iterator-style API for handling HTTP responses incrementally with **true socket-level streaming**.
+
+> **Important Notes**:
+>
+> - **No Keep-Alive**: Each `stream::Get()` call uses a dedicated connection that is closed after the response is fully read. For connection reuse, use `Client::Get()`.
+> - **Single iteration only**: The `next()` method can only iterate through the body once.
+> - **Result is not thread-safe**: While `stream::Get()` can be called from multiple threads simultaneously, the returned `stream::Result` must be used from a single thread only.
+
+## Overview
+
+The streaming API allows you to process HTTP response bodies chunk by chunk using an iterator-style pattern. Data is read directly from the network socket, enabling low-memory processing of large responses. This is particularly useful for:
+
+- **LLM/AI streaming responses** (e.g., ChatGPT, Claude, Ollama)
+- **Server-Sent Events (SSE)**
+- **Large file downloads** with progress tracking
+- **Reverse proxy implementations**
+
+## Quick Start
+
+```cpp
+#include "httplib.h"
+
+int main() {
+    httplib::Client cli("http://localhost:8080");
+    
+    // Get streaming response
+    auto result = httplib::stream::Get(cli, "/stream");
+    
+    if (result) {
+        // Process response body in chunks
+        while (result.next()) {
+            std::cout.write(result.data(), result.size());
+        }
+    }
+    
+    return 0;
+}
+```
+
+## API Layers
+
+cpp-httplib provides multiple API layers for different use cases:
+
+```text
+┌─────────────────────────────────────────────┐
+│  SSEClient                        │  ← SSE-specific, parsed events
+│  - on_message(), on_event()                 │
+│  - Auto-reconnect, Last-Event-ID            │
+├─────────────────────────────────────────────┤
+│  stream::Get() / stream::Result             │  ← Iterator-based streaming
+│  - while (result.next()) { ... }            │
+├─────────────────────────────────────────────┤
+│  open_stream() / StreamHandle               │  ← General-purpose streaming
+│  - handle.read(buf, len)                    │
+├─────────────────────────────────────────────┤
+│  Client::Get()                              │  ← Traditional, full buffering
+└─────────────────────────────────────────────┘
+```
+
+| Use Case | Recommended API |
+|----------|----------------|
+| SSE with auto-reconnect | `SSEClient` (see [README-sse.md](README-sse.md)) |
+| LLM streaming (JSON Lines) | `stream::Get()` |
+| Large file download | `stream::Get()` or `open_stream()` |
+| Reverse proxy | `open_stream()` |
+| Small responses with Keep-Alive | `Client::Get()` |
+
+## API Reference
+
+### Low-Level API: `StreamHandle`
+
+The `StreamHandle` struct provides direct control over streaming responses. It takes ownership of the socket connection and reads data directly from the network.
+
+> **Note:** When using `open_stream()`, the connection is dedicated to streaming and **Keep-Alive is not supported**. For Keep-Alive connections, use `client.Get()` instead.
+
+```cpp
+// Open a stream (takes ownership of socket)
+httplib::Client cli("http://localhost:8080");
+auto handle = cli.open_stream("GET", "/path");
+
+// Check validity
+if (handle.is_valid()) {
+    // Access response headers immediately
+    int status = handle.response->status;
+    auto content_type = handle.response->get_header_value("Content-Type");
+    
+    // Read body incrementally
+    char buf[4096];
+    ssize_t n;
+    while ((n = handle.read(buf, sizeof(buf))) > 0) {
+        process(buf, n);
+    }
+}
+```
+
+#### StreamHandle Members
+
+| Member | Type | Description |
+|--------|------|-------------|
+| `response` | `std::unique_ptr<Response>` | HTTP response with headers |
+| `error` | `Error` | Error code if request failed |
+| `is_valid()` | `bool` | Returns true if response is valid |
+| `read(buf, len)` | `ssize_t` | Read up to `len` bytes directly from socket |
+| `get_read_error()` | `Error` | Get the last read error |
+| `has_read_error()` | `bool` | Check if a read error occurred |
+
+### High-Level API: `stream::Get()` and `stream::Result`
+
+The `httplib.h` header provides a more ergonomic iterator-style API.
+
+```cpp
+#include "httplib.h"
+
+httplib::Client cli("http://localhost:8080");
+cli.set_follow_location(true);
+...
+
+// Simple GET
+auto result = httplib::stream::Get(cli, "/path");
+
+// GET with custom headers
+httplib::Headers headers = {{"Authorization", "Bearer token"}};
+auto result = httplib::stream::Get(cli, "/path", headers);
+
+// Process the response
+if (result) {
+    while (result.next()) {
+        process(result.data(), result.size());
+    }
+}
+
+// Or read entire body at once
+auto result2 = httplib::stream::Get(cli, "/path");
+if (result2) {
+    std::string body = result2.read_all();
+}
+```
+
+#### stream::Result Members
+
+| Member | Type | Description |
+|--------|------|-------------|
+| `operator bool()` | `bool` | Returns true if response is valid |
+| `is_valid()` | `bool` | Same as `operator bool()` |
+| `status()` | `int` | HTTP status code |
+| `headers()` | `const Headers&` | Response headers |
+| `get_header_value(key, def)` | `std::string` | Get header value (with optional default) |
+| `has_header(key)` | `bool` | Check if header exists |
+| `next()` | `bool` | Read next chunk, returns false when done |
+| `data()` | `const char*` | Pointer to current chunk data |
+| `size()` | `size_t` | Size of current chunk |
+| `read_all()` | `std::string` | Read entire remaining body into string |
+| `error()` | `Error` | Get the connection/request error |
+| `read_error()` | `Error` | Get the last read error |
+| `has_read_error()` | `bool` | Check if a read error occurred |
+
+## Usage Examples
+
+### Example 1: SSE (Server-Sent Events) Client
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://localhost:1234");
+    
+    auto result = httplib::stream::Get(cli, "/events");
+    if (!result) { return 1; }
+    
+    while (result.next()) {
+        std::cout.write(result.data(), result.size());
+        std::cout.flush();
+    }
+    
+    return 0;
+}
+```
+
+For a complete SSE client with auto-reconnection and event parsing, see `example/ssecli-stream.cc`.
+
+### Example 2: LLM Streaming Response
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://localhost:11434");  // Ollama
+    
+    auto result = httplib::stream::Get(cli, "/api/generate");
+    
+    if (result && result.status() == 200) {
+        while (result.next()) {
+            std::cout.write(result.data(), result.size());
+            std::cout.flush();
+        }
+    }
+    
+    // Check for connection errors
+    if (result.read_error() != httplib::Error::Success) {
+        std::cerr << "Connection lost\n";
+    }
+    
+    return 0;
+}
+```
+
+### Example 3: Large File Download with Progress
+
+```cpp
+#include "httplib.h"
+#include <fstream>
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://example.com");
+    auto result = httplib::stream::Get(cli, "/large-file.zip");
+    
+    if (!result || result.status() != 200) {
+        std::cerr << "Download failed\n";
+        return 1;
+    }
+    
+    std::ofstream file("download.zip", std::ios::binary);
+    size_t total = 0;
+    
+    while (result.next()) {
+        file.write(result.data(), result.size());
+        total += result.size();
+        std::cout << "\rDownloaded: " << (total / 1024) << " KB" << std::flush;
+    }
+    
+    std::cout << "\nComplete!\n";
+    return 0;
+}
+```
+
+### Example 4: Reverse Proxy Streaming
+
+```cpp
+#include "httplib.h"
+
+httplib::Server svr;
+
+svr.Get("/proxy/(.*)", [](const httplib::Request& req, httplib::Response& res) {
+    httplib::Client upstream("http://backend:8080");
+    auto handle = upstream.open_stream("/" + req.matches[1].str());
+    
+    if (!handle.is_valid()) {
+        res.status = 502;
+        return;
+    }
+    
+    res.status = handle.response->status;
+    res.set_chunked_content_provider(
+        handle.response->get_header_value("Content-Type"),
+        [handle = std::move(handle)](size_t, httplib::DataSink& sink) mutable {
+            char buf[8192];
+            auto n = handle.read(buf, sizeof(buf));
+            if (n > 0) {
+                sink.write(buf, static_cast<size_t>(n));
+                return true;
+            }
+            sink.done();
+            return true;
+        }
+    );
+});
+
+svr.listen("0.0.0.0", 3000);
+```
+
+## Comparison with Existing APIs
+
+| Feature | `Client::Get()` | `open_stream()` | `stream::Get()` |
+|---------|----------------|-----------------|----------------|
+| Headers available | After complete | Immediately | Immediately |
+| Body reading | All at once | Direct from socket | Iterator-based |
+| Memory usage | Full body in RAM | Minimal (controlled) | Minimal (controlled) |
+| Keep-Alive support | ✅ Yes | ❌ No | ❌ No |
+| Compression | Auto-handled | Auto-handled | Auto-handled |
+| Best for | Small responses, Keep-Alive | Low-level streaming | Easy streaming |
+
+## Features
+
+- **True socket-level streaming**: Data is read directly from the network socket
+- **Low memory footprint**: Only the current chunk is held in memory
+- **Compression support**: Automatic decompression for gzip, brotli, and zstd
+- **Chunked transfer**: Full support for chunked transfer encoding
+- **SSL/TLS support**: Works with HTTPS connections
+
+## Important Notes
+
+### Keep-Alive Behavior
+
+The streaming API (`stream::Get()` / `open_stream()`) takes ownership of the socket connection for the duration of the stream. This means:
+
+- **Keep-Alive is not supported** for streaming connections
+- The socket is closed when `StreamHandle` is destroyed
+- For Keep-Alive scenarios, use the standard `client.Get()` API instead
+
+```cpp
+// Use for streaming (no Keep-Alive)
+auto result = httplib::stream::Get(cli, "/large-stream");
+while (result.next()) { /* ... */ }
+
+// Use for Keep-Alive connections
+auto res = cli.Get("/api/data");  // Connection can be reused
+```
+
+## Related
+
+- [Issue #2269](https://github.com/yhirose/cpp-httplib/issues/2269) - Original feature request
+- [example/ssecli-stream.cc](./example/ssecli-stream.cc) - SSE client with auto-reconnection

README-websocket.md

@@ -0,0 +1,411 @@
+# WebSocket - RFC 6455 WebSocket Support
+
+A simple, blocking WebSocket implementation for C++11.
+
+> [!IMPORTANT]
+> This is a blocking I/O WebSocket implementation using a thread-per-connection model. If you need high-concurrency WebSocket support with non-blocking/async I/O (e.g., thousands of simultaneous connections), this is not the one that you want.
+
+## Features
+
+- **RFC 6455 compliant**: Full WebSocket protocol support
+- **Server and Client**: Both sides included
+- **SSL/TLS support**: `wss://` scheme for secure connections
+- **Text and Binary**: Both message types supported
+- **Automatic heartbeat**: Periodic Ping/Pong keeps connections alive
+- **Subprotocol negotiation**: `Sec-WebSocket-Protocol` support for GraphQL, MQTT, etc.
+
+## Quick Start
+
+### Server
+
+```cpp
+httplib::Server svr;
+
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send("echo: " + msg);
+    }
+});
+
+svr.listen("localhost", 8080);
+```
+
+### Client
+
+```cpp
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+
+if (ws.connect()) {
+    ws.send("hello");
+
+    std::string msg;
+    if (ws.read(msg)) {
+        std::cout << msg << std::endl;  // "echo: hello"
+    }
+    ws.close();
+}
+```
+
+## API Reference
+
+### ReadResult
+
+```cpp
+enum ReadResult : int {
+    Fail   = 0,  // Connection closed or error
+    Text   = 1,  // UTF-8 text message
+    Binary = 2,  // Binary message
+};
+```
+
+Returned by `read()`. Since `Fail` is `0`, the result works naturally in boolean contexts — `while (ws.read(msg))` continues until the connection closes. When you need to distinguish text from binary, check the return value directly.
+
+### CloseStatus
+
+```cpp
+enum class CloseStatus : uint16_t {
+    Normal = 1000,
+    GoingAway = 1001,
+    ProtocolError = 1002,
+    UnsupportedData = 1003,
+    NoStatus = 1005,
+    Abnormal = 1006,
+    InvalidPayload = 1007,
+    PolicyViolation = 1008,
+    MessageTooBig = 1009,
+    MandatoryExtension = 1010,
+    InternalError = 1011,
+};
+```
+
+### Server Registration
+
+```cpp
+// Basic handler
+Server &WebSocket(const std::string &pattern, WebSocketHandler handler);
+
+// With subprotocol negotiation
+Server &WebSocket(const std::string &pattern, WebSocketHandler handler,
+                  SubProtocolSelector sub_protocol_selector);
+```
+
+**Type aliases:**
+
+```cpp
+using WebSocketHandler =
+    std::function<void(const Request &, ws::WebSocket &)>;
+using SubProtocolSelector =
+    std::function<std::string(const std::vector<std::string> &protocols)>;
+```
+
+The `SubProtocolSelector` receives the list of subprotocols proposed by the client (from the `Sec-WebSocket-Protocol` header) and returns the selected one. Return an empty string to decline all proposed subprotocols.
+
+### WebSocket (Server-side)
+
+Passed to the handler registered with `Server::WebSocket()`. The handler runs in a dedicated thread per connection.
+
+```cpp
+// Read next message (blocks until received, returns Fail/Text/Binary)
+ReadResult read(std::string &msg);
+
+// Send messages
+bool send(const std::string &data);              // Text
+bool send(const char *data, size_t len);          // Binary
+
+// Close the connection
+void close(CloseStatus status = CloseStatus::Normal,
+           const std::string &reason = "");
+
+// Access the original HTTP upgrade request
+const Request &request() const;
+
+// Check if the connection is still open
+bool is_open() const;
+```
+
+### WebSocketClient
+
+```cpp
+// Constructor - accepts ws:// or wss:// URL
+explicit WebSocketClient(const std::string &scheme_host_port_path,
+                         const Headers &headers = {});
+
+// Check if the URL was parsed successfully
+bool is_valid() const;
+
+// Connect (performs HTTP upgrade handshake)
+bool connect();
+
+// Get the subprotocol selected by the server (empty if none)
+const std::string &subprotocol() const;
+
+// Read/Send/Close (same as server-side WebSocket)
+ReadResult read(std::string &msg);
+bool send(const std::string &data);
+bool send(const char *data, size_t len);
+void close(CloseStatus status = CloseStatus::Normal,
+           const std::string &reason = "");
+bool is_open() const;
+
+// Timeouts
+void set_read_timeout(time_t sec, time_t usec = 0);
+void set_write_timeout(time_t sec, time_t usec = 0);
+
+// SSL configuration (wss:// only, requires CPPHTTPLIB_OPENSSL_SUPPORT)
+void set_ca_cert_path(const std::string &path);
+void set_ca_cert_store(tls::ca_store_t store);
+void enable_server_certificate_verification(bool enabled);
+```
+
+## Examples
+
+### Echo Server with Connection Logging
+
+```cpp
+httplib::Server svr;
+
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    std::cout << "Connected from " << req.remote_addr << std::endl;
+
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send("echo: " + msg);
+    }
+
+    std::cout << "Disconnected" << std::endl;
+});
+
+svr.listen("localhost", 8080);
+```
+
+### Client: Continuous Read Loop
+
+```cpp
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+
+if (ws.connect()) {
+    ws.send("hello");
+    ws.send("world");
+
+    std::string msg;
+    while (ws.read(msg)) {           // blocks until a message arrives
+        std::cout << msg << std::endl; // "echo: hello", "echo: world"
+    }
+    // read() returns false when the server closes the connection
+}
+```
+
+### Text and Binary Messages
+
+Check the `ReadResult` return value to distinguish between text and binary:
+
+```cpp
+// Server
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    httplib::ws::ReadResult ret;
+    while ((ret = ws.read(msg))) {
+        if (ret == httplib::ws::Text) {
+            ws.send("echo: " + msg);
+        } else {
+            ws.send(msg.data(), msg.size());  // Binary echo
+        }
+    }
+});
+
+// Client
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+if (ws.connect()) {
+    // Send binary data
+    const char binary[] = {0x00, 0x01, 0x02, 0x03};
+    ws.send(binary, sizeof(binary));
+
+    // Receive and check the type
+    std::string msg;
+    if (ws.read(msg) == httplib::ws::Binary) {
+        // Process binary data in msg
+    }
+    ws.close();
+}
+```
+
+### SSL Client
+
+```cpp
+httplib::ws::WebSocketClient ws("wss://echo.example.com/ws");
+
+if (ws.connect()) {
+    ws.send("hello over TLS");
+
+    std::string msg;
+    if (ws.read(msg)) {
+        std::cout << msg << std::endl;
+    }
+    ws.close();
+}
+```
+
+### Close with Status
+
+```cpp
+// Client-side: close with a specific status code and reason
+ws.close(httplib::ws::CloseStatus::GoingAway, "shutting down");
+
+// Server-side: close with a policy violation status
+ws.close(httplib::ws::CloseStatus::PolicyViolation, "forbidden");
+```
+
+### Accessing the Upgrade Request
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    // Access headers from the original HTTP upgrade request
+    auto auth = req.get_header_value("Authorization");
+    if (auth.empty()) {
+        ws.close(httplib::ws::CloseStatus::PolicyViolation, "unauthorized");
+        return;
+    }
+
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send("echo: " + msg);
+    }
+});
+```
+
+### Custom Headers and Timeouts
+
+```cpp
+httplib::Headers headers = {
+    {"Authorization", "Bearer token123"}
+};
+
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws", headers);
+ws.set_read_timeout(30, 0);   // 30 seconds
+ws.set_write_timeout(10, 0);  // 10 seconds
+
+if (ws.connect()) {
+    std::string msg;
+    while (ws.read(msg)) {
+        std::cout << msg << std::endl;
+    }
+}
+```
+
+### Subprotocol Negotiation
+
+The server can negotiate a subprotocol with the client using `Sec-WebSocket-Protocol`. This is required for protocols like GraphQL over WebSocket (`graphql-ws`) and MQTT.
+
+```cpp
+// Server: register a handler with a subprotocol selector
+svr.WebSocket(
+    "/ws",
+    [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+        std::string msg;
+        while (ws.read(msg)) {
+            ws.send("echo: " + msg);
+        }
+    },
+    [](const std::vector<std::string> &protocols) -> std::string {
+        // The client proposed a list of subprotocols; pick one
+        for (const auto &p : protocols) {
+            if (p == "graphql-ws" || p == "graphql-transport-ws") {
+                return p;
+            }
+        }
+        return "";  // Decline all
+    });
+
+// Client: propose subprotocols via Sec-WebSocket-Protocol header
+httplib::Headers headers = {
+    {"Sec-WebSocket-Protocol", "graphql-ws, graphql-transport-ws"}
+};
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws", headers);
+
+if (ws.connect()) {
+    // Check which subprotocol the server selected
+    std::cout << "Subprotocol: " << ws.subprotocol() << std::endl;
+    // => "graphql-ws"
+    ws.close();
+}
+```
+
+### SSL Client with Certificate Configuration
+
+```cpp
+httplib::ws::WebSocketClient ws("wss://example.com/ws");
+ws.set_ca_cert_path("/path/to/ca-bundle.crt");
+ws.enable_server_certificate_verification(true);
+
+if (ws.connect()) {
+    ws.send("secure message");
+    ws.close();
+}
+```
+
+## Configuration
+
+| Macro                                       | Default           | Description                                              |
+|---------------------------------------------|-------------------|----------------------------------------------------------|
+| `CPPHTTPLIB_WEBSOCKET_MAX_PAYLOAD_LENGTH`   | `16777216` (16MB) | Maximum payload size per message                         |
+| `CPPHTTPLIB_WEBSOCKET_READ_TIMEOUT_SECOND`  | `300`             | Read timeout for WebSocket connections (seconds)         |
+| `CPPHTTPLIB_WEBSOCKET_CLOSE_TIMEOUT_SECOND` | `5`               | Timeout for waiting peer's Close response (seconds)      |
+| `CPPHTTPLIB_WEBSOCKET_PING_INTERVAL_SECOND` | `30`              | Automatic Ping interval for heartbeat (seconds)          |
+
+### Runtime Ping Interval
+
+You can override the ping interval at runtime instead of changing the compile-time macro. Set it to `0` to disable automatic pings entirely.
+
+```cpp
+// Server side
+httplib::Server svr;
+svr.set_websocket_ping_interval(10);  // 10 seconds
+
+// Or using std::chrono
+svr.set_websocket_ping_interval(std::chrono::seconds(10));
+
+// Client side
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+ws.set_websocket_ping_interval(10);  // 10 seconds
+
+// Disable automatic pings
+ws.set_websocket_ping_interval(0);
+```
+
+## Threading Model
+
+WebSocket connections share the same thread pool as HTTP requests. Each WebSocket connection occupies one thread for its entire lifetime.
+
+The default thread pool uses dynamic scaling: it maintains a base thread count of `CPPHTTPLIB_THREAD_POOL_COUNT` (8 or `std::thread::hardware_concurrency() - 1`, whichever is greater) and can scale up to 4x that count under load (`CPPHTTPLIB_THREAD_POOL_MAX_COUNT`). When all base threads are busy, temporary threads are spawned automatically up to the maximum. These dynamic threads exit after an idle timeout (`CPPHTTPLIB_THREAD_POOL_IDLE_TIMEOUT`, default 3 seconds).
+
+This dynamic scaling helps accommodate WebSocket connections alongside HTTP requests. However, if you expect many simultaneous WebSocket connections, you should configure the thread pool accordingly:
+
+```cpp
+httplib::Server svr;
+
+svr.new_task_queue = [] {
+  return new httplib::ThreadPool(/*base_threads=*/8, /*max_threads=*/128);
+};
+```
+
+Choose sizes that account for both your expected HTTP load and the maximum number of simultaneous WebSocket connections.
+
+## Protocol
+
+The implementation follows [RFC 6455](https://tools.ietf.org/html/rfc6455):
+
+- Handshake via HTTP Upgrade with `Sec-WebSocket-Key` / `Sec-WebSocket-Accept`
+- Subprotocol negotiation via `Sec-WebSocket-Protocol`
+- Frame masking (client-to-server)
+- Control frames: Close, Ping, Pong
+- Message fragmentation and reassembly
+- Close handshake with status codes
+
+## Browser Test
+
+Run the echo server example and open `http://localhost:8080` in a browser:
+
+```bash
+cd example && make wsecho && ./wsecho
+```

README.md

@@ -1,19 +1,29 @@
-cpp-httplib
-===========
+# cpp-httplib
 
 [![](https://github.com/yhirose/cpp-httplib/workflows/test/badge.svg)](https://github.com/yhirose/cpp-httplib/actions)
 
-A C++11 single-file header-only cross platform HTTP/HTTPS library.
+A C++11 single-file header-only cross platform HTTP/HTTPS library.<br>
+It's extremely easy to set up. Just include the **[httplib.h](https://raw.githubusercontent.com/yhirose/cpp-httplib/refs/heads/master/httplib.h)** file in your code!
 
-It's extremely easy to set up. Just include the **httplib.h** file in your code!
+Learn more in the [official documentation](https://yhirose.github.io/cpp-httplib/) (built with [docs-gen](https://github.com/yhirose/docs-gen)).
 
 > [!IMPORTANT]
 > This library uses 'blocking' socket I/O. If you are looking for a library with 'non-blocking' socket I/O, this is not the one that you want.
 
-Simple examples
----------------
+> [!WARNING]
+> 32-bit platforms are **NOT supported**. Use at your own risk. The library may compile on 32-bit targets, but no security review has been conducted for 32-bit environments. Integer truncation and other 32-bit-specific issues may exist. **Security reports that only affect 32-bit platforms will be closed without action.** The maintainer does not have access to 32-bit environments for testing or fixing issues. CI includes basic compile checks only, not functional or security testing.
 
-#### Server (Multi-threaded)
+## Main Features
+
+- HTTP Server/Client
+- SSL/TLS support (OpenSSL, MbedTLS, wolfSSL)
+- [Stream API](README-stream.md)
+- [Server-Sent Events](README-sse.md)
+- [WebSocket](README-websocket.md)
+
+## Simple examples
+
+### Server
 
 ```c++
 #define CPPHTTPLIB_OPENSSL_SUPPORT
@@ -32,7 +42,7 @@ svr.Get("/hi", [](const httplib::Request &, httplib::Response &res) {
 svr.listen("0.0.0.0", 8080);
 ```
 
-#### Client
+### Client
 
 ```c++
 #define CPPHTTPLIB_OPENSSL_SUPPORT
@@ -44,24 +54,28 @@ httplib::Client cli("http://yhirose.github.io");
 // HTTPS
 httplib::Client cli("https://yhirose.github.io");
 
-auto res = cli.Get("/hi");
-res->status;
-res->body;
+if (auto res = cli.Get("/hi")) {
+  res->status;
+  res->body;
+}
 ```
 
-SSL Support
------------
+## SSL/TLS Support
 
-SSL support is available with `CPPHTTPLIB_OPENSSL_SUPPORT`. `libssl` and `libcrypto` should be linked.
+cpp-httplib supports multiple TLS backends through an abstraction layer:
+
+| Backend | Define | Libraries | Notes |
+| :------ | :----- | :-------- | :---- |
+| OpenSSL | `CPPHTTPLIB_OPENSSL_SUPPORT` | `libssl`, `libcrypto` | [3.0 or later](https://www.openssl.org/policies/releasestrat.html) required |
+| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` | 2.x and 3.x supported (auto-detected) |
+| wolfSSL | `CPPHTTPLIB_WOLFSSL_SUPPORT` | `libwolfssl` | 5.x supported; must build with `--enable-opensslall` |
 
 > [!NOTE]
-> cpp-httplib currently supports only version 3.0 or later. Please see [this page](https://www.openssl.org/policies/releasestrat.html) to get more information.
-
-> [!TIP]
-> For macOS: cpp-httplib now can use system certs with `CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN`. `CoreFoundation` and `Security` should be linked with `-framework`.
+> **Mbed TLS / wolfSSL limitation:** `get_ca_certs()` and `get_ca_names()` only reflect CA certificates loaded via `load_ca_cert_store()`. Certificates loaded through `set_ca_cert_path()` or system certificates (`load_system_certs`) are not enumerable.
 
 ```c++
-#define CPPHTTPLIB_OPENSSL_SUPPORT
+// Use either OpenSSL, Mbed TLS, or wolfSSL
+#define CPPHTTPLIB_OPENSSL_SUPPORT   // or CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT
 #include "path/to/httplib.h"
 
 // Server
@@ -82,15 +96,15 @@ cli.enable_server_certificate_verification(false);
 cli.enable_server_hostname_verification(false);
 ```
 
-> [!NOTE]
-> When using SSL, it seems impossible to avoid SIGPIPE in all cases, since on some operating systems, SIGPIPE can only be suppressed on a per-message basis, but there is no way to make the OpenSSL library do so for its internal communications. If your program needs to avoid being terminated on SIGPIPE, the only fully general way might be to set up a signal handler for SIGPIPE to handle or ignore it yourself.
-
 ### SSL Error Handling
 
-When SSL operations fail, cpp-httplib provides detailed error information through two separate error fields:
+When SSL operations fail, cpp-httplib provides detailed error information through `ssl_error()` and `ssl_backend_error()`:
+
+- `ssl_error()` - Returns the TLS-level error code (e.g., `SSL_ERROR_SSL` for OpenSSL)
+- `ssl_backend_error()` - Returns the backend-specific error code (e.g., `ERR_get_error()` for OpenSSL/wolfSSL, return value for Mbed TLS)
 
 ```c++
-#define CPPHTTPLIB_OPENSSL_SUPPORT
+#define CPPHTTPLIB_OPENSSL_SUPPORT  // or CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT
 #include "path/to/httplib.h"
 
 httplib::Client cli("https://example.com");
@@ -107,18 +121,18 @@ if (!res) {
       break;
 
     case httplib::Error::SSLLoadingCerts:
-      std::cout << "SSL cert loading failed, OpenSSL error: "
-                << std::hex << res.ssl_openssl_error() << std::endl;
+      std::cout << "SSL cert loading failed, backend error: "
+                << std::hex << res.ssl_backend_error() << std::endl;
       break;
 
     case httplib::Error::SSLServerVerification:
-      std::cout << "SSL verification failed, X509 error: "
-                << res.ssl_openssl_error() << std::endl;
+      std::cout << "SSL verification failed, verify error: "
+                << res.ssl_backend_error() << std::endl;
       break;
 
     case httplib::Error::SSLServerHostnameVerification:
-      std::cout << "SSL hostname verification failed, X509 error: "
-                << res.ssl_openssl_error() << std::endl;
+      std::cout << "SSL hostname verification failed, verify error: "
+                << res.ssl_backend_error() << std::endl;
       break;
 
     default:
@@ -127,8 +141,69 @@ if (!res) {
 }
 ```
 
-Server
-------
+### Custom Certificate Verification
+
+You can set a custom verification callback using `tls::VerifyCallback`:
+
+```c++
+httplib::Client cli("https://example.com");
+
+cli.set_server_certificate_verifier(
+    [](const httplib::tls::VerifyContext &ctx) -> bool {
+      std::cout << "Subject CN: " << ctx.subject_cn() << std::endl;
+      std::cout << "Issuer: " << ctx.issuer_name() << std::endl;
+      std::cout << "Depth: " << ctx.depth << std::endl;
+      std::cout << "Pre-verified: " << ctx.preverify_ok << std::endl;
+
+      // Inspect SANs (Subject Alternative Names)
+      for (const auto &san : ctx.sans()) {
+        std::cout << "SAN: " << san.value << std::endl;
+      }
+
+      // Return true to accept, false to reject
+      return ctx.preverify_ok;
+    });
+```
+
+### Peer Certificate Inspection
+
+On the server side, you can inspect the client's peer certificate from a request handler:
+
+```c++
+httplib::SSLServer svr("./cert.pem", "./key.pem",
+                       "./client-ca-cert.pem");
+
+svr.Get("/", [](const httplib::Request &req, httplib::Response &res) {
+  auto cert = req.peer_cert();
+  if (cert) {
+    std::cout << "Client CN: " << cert.subject_cn() << std::endl;
+    std::cout << "Serial: " << cert.serial() << std::endl;
+  }
+
+  auto sni = req.sni();
+  std::cout << "SNI: " << sni << std::endl;
+});
+```
+
+### Platform-specific Certificate Handling
+
+cpp-httplib automatically integrates with the OS certificate store on macOS and Windows. This works with all TLS backends.
+
+| Platform | Behavior | Disable (compile time) |
+| :------- | :------- | :--------------------- |
+| macOS | Loads system certs from Keychain (link `CoreFoundation` and `Security` with `-framework`) | `CPPHTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES` |
+| Windows | Verifies certs via CryptoAPI (`CertGetCertificateChain` / `CertVerifyCertificateChainPolicy`) with revocation checking | `CPPHTTPLIB_DISABLE_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE` |
+
+On Windows, verification can also be disabled at runtime:
+
+```c++
+cli.enable_windows_certificate_verification(false);
+```
+
+> [!NOTE]
+> When using SSL, it seems impossible to avoid SIGPIPE in all cases, since on some operating systems, SIGPIPE can only be suppressed on a per-message basis, but there is no way to make the OpenSSL library do so for its internal communications. If your program needs to avoid being terminated on SIGPIPE, the only fully general way might be to set up a signal handler for SIGPIPE to handle or ignore it yourself.
+
+## Server
 
 ```c++
 #include <httplib.h>
@@ -190,7 +265,7 @@ int main(void)
 }
 ```
 
-`Post`, `Put`, `Delete` and `Options` methods are also supported.
+`Post`, `Put`, `Patch`, `Delete` and `Options` methods are also supported.
 
 ### Bind a socket to multiple interfaces and any available port
 
@@ -257,6 +332,11 @@ The following are built-in mappings:
 > [!WARNING]
 > These static file server methods are not thread-safe.
 
+<!-- -->
+
+> [!NOTE]
+> On POSIX systems, the static file server rejects requests that resolve (via symlinks) to a path outside the mounted base directory. Ensure that the served directory has appropriate permissions, as managing access to the served directory is the application developer's responsibility.
+
 ### File request handler
 
 ```cpp
@@ -379,6 +459,34 @@ svr.set_pre_request_handler([](const auto& req, auto& res) {
 });
 ```
 
+### Response user data
+
+`res.user_data` is a `std::map<std::string, httplib::any>` that lets pre-routing or pre-request handlers pass arbitrary data to route handlers.
+
+```cpp
+struct AuthContext {
+  std::string user_id;
+  std::string role;
+};
+
+svr.set_pre_routing_handler([](const auto& req, auto& res) {
+  auto token = req.get_header_value("Authorization");
+  res.user_data["auth"] = AuthContext{decode_token(token)};
+  return Server::HandlerResponse::Unhandled;
+});
+
+svr.Get("/me", [](const auto& /*req*/, auto& res) {
+  auto* ctx = httplib::any_cast<AuthContext>(&res.user_data["auth"]);
+  if (!ctx) {
+    res.status = StatusCode::Unauthorized_401;
+    return;
+  }
+  res.set_content("Hello " + ctx->user_id, "text/plain");
+});
+```
+
+`httplib::any` mirrors the C++17 `std::any` API. On C++17 and later it is an alias for `std::any`; on C++11/14 a compatible implementation is provided.
+
 ### Form data handling
 
 #### URL-encoded form data ('application/x-www-form-urlencoded')
@@ -419,8 +527,17 @@ svr.Post("/multipart", [&](const Request& req, Response& res) {
       std::cout << "Header: " << header.first << " = " << header.second << std::endl;
     }
 
+    // IMPORTANT: file.filename is an untrusted value from the client.
+    // Always sanitize to prevent path traversal attacks.
+    auto safe_name = httplib::sanitize_filename(file.filename);
+    if (safe_name.empty()) {
+      res.status = StatusCode::BadRequest_400;
+      res.set_content("Invalid filename", "text/plain");
+      return;
+    }
+
     // Save to disk
-    std::ofstream ofs(file.filename, std::ios::binary);
+    std::ofstream ofs(upload_dir + "/" + safe_name, std::ios::binary);
     ofs << file.content;
   }
 
@@ -456,6 +573,16 @@ svr.Post("/multipart", [&](const Request& req, Response& res) {
 });
 ```
 
+#### Filename Sanitization
+
+`file.filename` in multipart uploads is an untrusted value from the client. Always sanitize before using it in file paths:
+
+```cpp
+auto safe = httplib::sanitize_filename(file.filename);
+```
+
+This function strips path separators (`/`, `\`), null bytes, leading/trailing whitespace, and rejects `.` and `..`. Returns an empty string if the filename is unsafe.
+
 ### Receive content with a content receiver
 
 ```cpp
@@ -633,20 +760,24 @@ Please see [Server example](https://github.com/yhirose/cpp-httplib/blob/master/e
 
 ### Default thread pool support
 
-`ThreadPool` is used as the **default** task queue, with a default thread count of 8 or `std::thread::hardware_concurrency() - 1`, whichever is greater. You can change it with `CPPHTTPLIB_THREAD_POOL_COUNT`.
+`ThreadPool` is used as the **default** task queue, with dynamic scaling support. By default, it maintains a base thread count of 8 or `std::thread::hardware_concurrency() - 1` (whichever is greater), and can scale up to 4x that count under load. You can change these with `CPPHTTPLIB_THREAD_POOL_COUNT` and `CPPHTTPLIB_THREAD_POOL_MAX_COUNT`.
 
-If you want to set the thread count at runtime, there is no convenient way... But here is how.
+When all threads are busy and a new task arrives, a temporary thread is spawned (up to the maximum). When a dynamic thread finishes its task and the queue is empty, or after an idle timeout, it exits automatically. The idle timeout defaults to 3 seconds, configurable via `CPPHTTPLIB_THREAD_POOL_IDLE_TIMEOUT`.
+
+If you want to set the thread counts at runtime:
 
 ```cpp
-svr.new_task_queue = [] { return new ThreadPool(12); };
+svr.new_task_queue = [] { return new ThreadPool(/*base_threads=*/8, /*max_threads=*/64); };
 ```
 
+#### Max queued requests
+
 You can also provide an optional parameter to limit the maximum number
 of pending requests, i.e. requests `accept()`ed by the listener but
 still waiting to be serviced by worker threads.
 
 ```cpp
-svr.new_task_queue = [] { return new ThreadPool(/*num_threads=*/12, /*max_queued_requests=*/18); };
+svr.new_task_queue = [] { return new ThreadPool(/*base_threads=*/12, /*max_threads=*/0, /*max_queued_requests=*/18); };
 ```
 
 Default limit is 0 (unlimited). Once the limit is reached, the listener
@@ -682,8 +813,7 @@ svr.new_task_queue = [] {
 };
 ```
 
-Client
-------
+## Client
 
 ```c++
 #include <httplib.h>
@@ -721,7 +851,7 @@ httplib::SSLClient cli("localhost");
 Here is the list of errors from `Result::error()`.
 
 ```c++
-enum Error {
+enum class Error {
   Success = 0,
   Unknown,
   Connection,
@@ -738,6 +868,24 @@ enum Error {
   Compression,
   ConnectionTimeout,
   ProxyConnection,
+  ConnectionClosed,
+  Timeout,
+  ResourceExhaustion,
+  TooManyFormDataFiles,
+  ExceedMaxPayloadSize,
+  ExceedUriMaxLength,
+  ExceedMaxSocketDescriptorCount,
+  InvalidRequestLine,
+  InvalidHTTPMethod,
+  InvalidHTTPVersion,
+  InvalidHeaders,
+  MultipartParsing,
+  OpenFile,
+  Listen,
+  GetSockName,
+  UnsupportedAddressFamily,
+  HTTPParsing,
+  InvalidRangeHeader,
 };
 ```
 
@@ -794,11 +942,15 @@ httplib::Headers headers = {
 };
 auto res = cli.Get("/hi", headers);
 ```
+
 or
+
 ```c++
 auto res = cli.Get("/hi", {{"Hello", "World!"}});
 ```
+
 or
+
 ```c++
 cli.set_default_headers({
   { "Hello", "World!" }
@@ -847,12 +999,38 @@ httplib::UploadFormDataItems items = {
 auto res = cli.Post("/multipart", items);
 ```
 
+To upload files from disk without loading them entirely into memory, use `make_file_provider`. The file is sent with chunked transfer encoding.
+
+```cpp
+httplib::FormDataProviderItems providers = {
+  httplib::make_file_provider("file1", "/path/to/large.bin", "large.bin", "application/octet-stream"),
+  httplib::make_file_provider("avatar", "/path/to/photo.jpg", "photo.jpg", "image/jpeg"),
+};
+
+auto res = cli.Post("/upload", {}, {}, providers);
+```
+
+### POST with a file body
+
+To POST a file as a raw binary body with `Content-Length`, use `make_file_body`.
+
+```cpp
+auto [size, provider] = httplib::make_file_body("/path/to/data.bin");
+auto res = cli.Post("/upload", size, provider, "application/octet-stream");
+```
+
 ### PUT
 
 ```c++
 res = cli.Put("/resource/foo", "text", "text/plain");
 ```
 
+### PATCH
+
+```c++
+res = cli.Patch("/resource/foo", "text", "text/plain");
+```
+
 ### DELETE
 
 ```c++
@@ -877,6 +1055,12 @@ cli.set_write_timeout(5, 0); // 5 seconds
 cli.set_max_timeout(5000); // 5 seconds
 ```
 
+### Set maximum payload length for reading a response body
+
+```c++
+cli.set_payload_max_length(1024 * 1024 * 512); // 512MB
+```
+
 ### Receive content with a content receiver
 
 ```c++
@@ -987,7 +1171,7 @@ cli.set_proxy_bearer_token_auth("pass");
 ### Range
 
 ```cpp
-httplib::Client cli("httpbin.org");
+httplib::Client cli("httpcan.org");
 
 auto res = cli.Get("/range/32", {
   httplib::make_range_header({{1, 10}}) // 'Range: bytes=1-10'
@@ -1077,18 +1261,21 @@ httplib::Server svr;
 svr.listen("127.0.0.1", 8080);
 ```
 
-Compression
------------
+## Payload Limit
+
+The maximum payload body size is limited to 100MB by default for both server and client. You can change it with `set_payload_max_length()` or by defining `CPPHTTPLIB_PAYLOAD_MAX_LENGTH` at compile time. Setting it to `0` disables the limit entirely.
+
+## Compression
 
 The server can apply compression to the following MIME type contents:
 
-  * all text types except text/event-stream
-  * image/svg+xml
-  * application/javascript
-  * application/json
-  * application/xml
-  * application/protobuf
-  * application/xhtml+xml
+- all text types except text/event-stream
+- image/svg+xml
+- application/javascript
+- application/json
+- application/xml
+- application/protobuf
+- application/xhtml+xml
 
 ### Zlib Support
 
@@ -1181,9 +1368,95 @@ std::string decoded_component = httplib::decode_uri_component(encoded_component)
 
 Use `encode_uri()` for full URLs and `encode_uri_component()` for individual query parameters or path segments.
 
+## Stream API
 
-Split httplib.h into .h and .cc
--------------------------------
+Process large responses without loading everything into memory.
+
+```c++
+httplib::Client cli("localhost", 8080);
+cli.set_follow_location(true);
+...
+
+auto result = httplib::stream::Get(cli, "/large-file");
+if (result) {
+  while (result.next()) {
+    process(result.data(), result.size());  // Process each chunk as it arrives
+  }
+}
+
+// Or read the entire body at once
+auto result2 = httplib::stream::Get(cli, "/file");
+if (result2) {
+  std::string body = result2.read_all();
+}
+```
+
+All HTTP methods are supported: `stream::Get`, `Post`, `Put`, `Patch`, `Delete`, `Head`, `Options`.
+
+See [README-stream.md](README-stream.md) for more details.
+
+## SSE Client
+
+```cpp
+#include <httplib.h>
+
+int main() {
+    httplib::Client cli("http://localhost:8080");
+    httplib::sse::SSEClient sse(cli, "/events");
+
+    sse.on_message([](const httplib::sse::SSEMessage &msg) {
+        std::cout << "Event: " << msg.event << std::endl;
+        std::cout << "Data: " << msg.data << std::endl;
+    });
+
+    sse.start();  // Blocking, with auto-reconnect
+    return 0;
+}
+```
+
+See [README-sse.md](README-sse.md) for more details.
+
+## WebSocket
+
+```cpp
+// Server
+httplib::Server svr;
+
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    httplib::ws::Message msg;
+    while (ws.read(msg)) {
+        if (msg.is_text()) {
+            ws.send("Echo: " + msg.data);
+        }
+    }
+});
+
+svr.listen("localhost", 8080);
+```
+
+```cpp
+// Client
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+
+if (ws.connect()) {
+    ws.send("Hello, WebSocket!");
+
+    std::string msg;
+    if (ws.read(msg)) {
+        std::cout << "Received: " << msg << std::endl;
+    }
+
+    ws.close();
+}
+```
+
+SSL is also supported via `wss://` scheme (e.g. `WebSocketClient("wss://example.com/ws")`). Subprotocol negotiation (`Sec-WebSocket-Protocol`) is supported via `SubProtocolSelector` callback.
+
+> **Note:** WebSocket connections occupy a thread for their entire lifetime. If you plan to handle many simultaneous WebSocket connections, consider using a dynamic thread pool: `svr.new_task_queue = [] { return new ThreadPool(8, 64); };`
+
+See [README-websocket.md](README-websocket.md) for more details.
+
+## Split httplib.h into .h and .cc
 
 ```console
 $ ./split.py -h
@@ -1201,8 +1474,7 @@ $ ./split.py
 Wrote out/httplib.h and out/httplib.cc
 ```
 
-Dockerfile for Static HTTP Server
----------------------------------
+## Dockerfile for Static HTTP Server
 
 Dockerfile for static HTTP server is available. Port number of this HTTP server is 80, and it serves static files from `/html` directory in the container.
 
@@ -1273,12 +1545,10 @@ Include `httplib.h` before `Windows.h` or include `Windows.h` by defining `WIN32
 > [!NOTE]
 > Windows 8 or lower, Visual Studio 2015 or lower, and Cygwin and MSYS2 including MinGW are neither supported nor tested.
 
-License
--------
+## License
 
-MIT license (© 2025 Yuji Hirose)
+MIT license (© 2026 Yuji Hirose)
 
-Special Thanks To
------------------
+## Special Thanks To
 
 [These folks](https://github.com/yhirose/cpp-httplib/graphs/contributors) made great contributions to polish this library to totally another level from a simple toy!

benchmark/Makefile

@@ -1,4 +1,7 @@
-CXXFLAGS = -std=c++11 -O2 -I..
+CXXFLAGS = -O2 -I..
+
+CPPHTTPLIB_CXXFLAGS = -std=c++11
+CROW_CXXFLAGS = -std=c++17
 
 CPPHTTPLIB_FLAGS = -DCPPHTTPLIB_THREAD_POOL_COUNT=16
 
@@ -18,11 +21,11 @@ run : server
 	@./server
 
 server : cpp-httplib/main.cpp ../httplib.h
-	@g++ -o $@ $(CXXFLAGS) $(CPPHTTPLIB_FLAGS) cpp-httplib/main.cpp
+	@g++ -o $@ $(CXXFLAGS) $(CPPHTTPLIB_CXXFLAGS) $(CPPHTTPLIB_FLAGS) cpp-httplib/main.cpp
 
 # crow
 bench-crow: server-crow
-	@echo "-------------\n Crow v1.2.0\n-------------\n"
+	@echo "-------------\n Crow v1.3.1\n-------------\n"
 	@./server-crow & export PID=$$!; $(BENCH); kill $${PID}
 	@echo ""
 
@@ -32,8 +35,8 @@ monitor-crow: server-crow
 run-crow : server-crow
 	@./server-crow
 
-server-crow : crow/main.cpp
-	@g++ -o $@ $(CXXFLAGS) crow/main.cpp
+server-crow : crow/main.cpp crow/crow_all.h
+	@g++ -o $@ $(CXXFLAGS) $(CROW_CXXFLAGS) crow/main.cpp
 
 # misc
 build: server server-crow

benchmark/crow/main.cpp

@@ -2,7 +2,7 @@
 
 class CustomLogger : public crow::ILogHandler {
 public:
-  void log(std::string, crow::LogLevel) {}
+  void log(const std::string &, crow::LogLevel) {}
 };
 
 int main() {

cmake/httplibConfig.cmake.in

@@ -4,6 +4,8 @@
 # Setting these here so they're accessible after install.
 # Might be useful for some users to check which settings were used.
 set(HTTPLIB_IS_USING_OPENSSL @HTTPLIB_IS_USING_OPENSSL@)
+set(HTTPLIB_IS_USING_WOLFSSL @HTTPLIB_IS_USING_WOLFSSL@)
+set(HTTPLIB_IS_USING_MBEDTLS @HTTPLIB_IS_USING_MBEDTLS@)
 set(HTTPLIB_IS_USING_ZLIB @HTTPLIB_IS_USING_ZLIB@)
 set(HTTPLIB_IS_COMPILED @HTTPLIB_COMPILE@)
 set(HTTPLIB_IS_USING_BROTLI @HTTPLIB_IS_USING_BROTLI@)
@@ -25,11 +27,22 @@ if(@HTTPLIB_IS_USING_OPENSSL@)
 	endif()
 	set(httplib_OpenSSL_FOUND ${OpenSSL_FOUND})
 endif()
+
 if(@HTTPLIB_IS_USING_ZLIB@)
 	find_dependency(ZLIB)
 	set(httplib_ZLIB_FOUND ${ZLIB_FOUND})
 endif()
 
+if(@HTTPLIB_IS_USING_WOLFSSL@)
+	find_dependency(wolfssl)
+	set(httplib_wolfssl_FOUND ${wolfssl_FOUND})
+endif()
+
+if(@HTTPLIB_IS_USING_MBEDTLS@)
+	find_dependency(MbedTLS)
+	set(httplib_MbedTLS_FOUND ${MbedTLS_FOUND})
+endif()
+
 if(@HTTPLIB_IS_USING_BROTLI@)
 	# Needed so we can use our own FindBrotli.cmake in this file.
 	# Note that the FindBrotli.cmake file is installed in the same dir as this file.

cmake/modules.cmake

@@ -0,0 +1,16 @@
+# This file contains C++20 module support requiring CMake 3.28+
+# Included conditionally to prevent parse errors on older CMake versions
+
+if(HTTPLIB_BUILD_MODULES)
+	if(POLICY CMP0155)
+		cmake_policy(SET CMP0155 NEW)
+	endif()
+
+	set(CMAKE_CXX_SCAN_FOR_MODULES ON)
+	
+	target_sources(${PROJECT_NAME}
+		PUBLIC
+			FILE_SET CXX_MODULES FILES
+				"${_httplib_build_includedir}/httplib.cppm"
+	)
+endif()

docker/main.cc

@@ -1,7 +1,7 @@
 //
 //  main.cc
 //
-//  Copyright (c) 2025 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 

docs-src/config.toml

@@ -0,0 +1,30 @@
+[system]
+theme = "monotone"
+langs = ["en", "ja"]
+
+[site]
+title = "cpp-httplib"
+version = "0.38.0"
+hostname = "https://yhirose.github.io"
+base_path = "/cpp-httplib"
+footer_message = "© 2026 Yuji Hirose. All rights reserved."
+
+[[nav]]
+label = "Tour"
+path = "tour/"
+icon_svg = '<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>'
+
+[[nav]]
+label = "Cookbook"
+path = "cookbook/"
+icon_svg = '<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 19.5A2.5 2.5 0 0 1 6.5 17H20"/><path d="M6.5 2H20v20H6.5A2.5 2.5 0 0 1 4 19.5v-15A2.5 2.5 0 0 1 6.5 2z"/></svg>'
+
+[[nav]]
+label = "LLM App"
+path = "llm-app/"
+icon_svg = '<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 19.5A2.5 2.5 0 0 1 6.5 17H20"/><path d="M6.5 2H20v20H6.5A2.5 2.5 0 0 1 4 19.5v-15A2.5 2.5 0 0 1 6.5 2z"/></svg>'
+
+[[nav]]
+label = "GitHub"
+url = "https://github.com/yhirose/cpp-httplib"
+icon_svg = '<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 19c-5 1.5-5-2.5-7-3m14 6v-3.87a3.37 3.37 0 0 0-.94-2.61c3.14-.35 6.44-1.54 6.44-7A5.44 5.44 0 0 0 20 4.77 5.07 5.07 0 0 0 19.91 1S18.73.65 16 2.48a13.38 13.38 0 0 0-7 0C6.27.65 5.09 1 5.09 1A5.07 5.07 0 0 0 5 4.77a5.44 5.44 0 0 0-1.5 3.78c0 5.42 3.3 6.61 6.44 7A3.37 3.37 0 0 0 9 18.13V22"/></svg>'

docs-src/pages/en/cookbook/index.md

@@ -0,0 +1,95 @@
+---
+title: "Cookbook"
+order: 0
+---
+
+A collection of recipes that answer "How do I...?" questions. Each recipe is self-contained — read only what you need.
+
+## Client
+
+### Basics
+- Get the response body as a string / save to a file
+- Send and receive JSON
+- Set default headers (`set_default_headers`)
+- Follow redirects (`set_follow_location`)
+
+### Authentication
+- Use Basic authentication (`set_basic_auth`)
+- Call an API with a Bearer token
+
+### File Upload
+- Upload a file as multipart form data (`make_file_provider`)
+- POST a file as raw binary (`make_file_body`)
+- Send the body with chunked transfer (Content Provider)
+
+### Streaming & Progress
+- Receive a response as a stream
+- Use the progress callback (`DownloadProgress` / `UploadProgress`)
+
+### Connection & Performance
+- Set timeouts (`set_connection_timeout` / `set_read_timeout`)
+- Set an overall timeout (`set_max_timeout`)
+- Understand connection reuse and Keep-Alive behavior
+- Enable compression (`set_compress` / `set_decompress`)
+- Send requests through a proxy (`set_proxy`)
+
+### Error Handling & Debugging
+- Handle error codes (`Result::error()`)
+- Handle SSL errors (`ssl_error()` / `ssl_backend_error()`)
+- Set up client logging (`set_logger` / `set_error_logger`)
+
+## Server
+
+### Basics
+- Register GET / POST / PUT / DELETE handlers
+- Receive JSON requests and return JSON responses
+- Use path parameters (`/users/:id`)
+- Set up a static file server (`set_mount_point`)
+
+### Streaming & Files
+- Stream a large file in the response (`ContentProvider`)
+- Return a file download response (`Content-Disposition`)
+- Receive multipart data as a stream (`ContentReader`)
+- Compress responses (gzip)
+
+### Handler Chain
+- Add pre-processing to all routes (Pre-routing handler)
+- Add response headers with a Post-routing handler (CORS, etc.)
+- Authenticate per route with a Pre-request handler (`matched_route`)
+- Pass data between handlers with `res.user_data`
+
+### Error Handling & Debugging
+- Return custom error pages (`set_error_handler`)
+- Catch exceptions (`set_exception_handler`)
+- Log requests (Logger)
+- Detect client disconnection (`req.is_connection_closed()`)
+
+### Operations & Tuning
+- Assign a port dynamically (`bind_to_any_port`)
+- Control startup order with `listen_after_bind`
+- Shut down gracefully (`stop()` and signal handling)
+- Tune Keep-Alive (`set_keep_alive_max_count` / `set_keep_alive_timeout`)
+- Configure the thread pool (`new_task_queue`)
+
+## TLS / Security
+
+- Choosing between OpenSSL, mbedTLS, and wolfSSL (build-time `#define` differences)
+- Control SSL certificate verification (disable, custom CA, custom callback)
+- Use a custom certificate verification callback (`set_server_certificate_verifier`)
+- Set up an SSL/TLS server (certificate and private key)
+- Configure mTLS (mutual TLS with client certificates)
+- Access the peer certificate on the server (`req.peer_cert()` / SNI)
+
+## SSE
+
+- Implement an SSE server
+- Use event names to distinguish event types
+- Handle reconnection (`Last-Event-ID`)
+- Receive SSE events on the client
+
+## WebSocket
+
+- Implement a WebSocket echo server and client
+- Configure heartbeats (`set_websocket_ping_interval` / `CPPHTTPLIB_WEBSOCKET_PING_INTERVAL_SECOND`)
+- Handle connection close
+- Send and receive binary frames

docs-src/pages/en/index.md

@@ -0,0 +1,22 @@
+---
+title: "cpp-httplib"
+order: 0
+---
+
+[cpp-httplib](https://github.com/yhirose/cpp-httplib) is an HTTP/HTTPS library for C++. Just copy a single header file, [`httplib.h`](https://github.com/yhirose/cpp-httplib/raw/refs/tags/latest/httplib.h), and you're ready to go.
+
+When you need a quick HTTP server or client in C++, you want something that just works. That's exactly why I built cpp-httplib. You can start writing both servers and clients in just a few lines of code.
+
+The API uses a lambda-based design that feels natural. It runs anywhere you have a C++11 or later compiler. Windows, macOS, Linux — use whatever environment you already have.
+
+HTTPS works too. Just link OpenSSL or mbedTLS, and both server and client gain TLS support. Content-Encoding (gzip, Brotli, etc.), file uploads, and other features you actually need in real-world development are all included. WebSocket is also supported.
+
+Under the hood, it uses blocking I/O with a thread pool. It's not built for handling massive numbers of simultaneous connections. But for API servers, embedded HTTP in tools, mock servers for testing, and many other use cases, it delivers solid performance.
+
+"Solve today's problem, today." That's the kind of simplicity cpp-httplib aims for.
+
+## Documentation
+
+- [A Tour of cpp-httplib](tour/) — A step-by-step tutorial covering the basics. Start here if you're new
+- [Cookbook](cookbook/) — A collection of recipes organized by topic. Jump to whatever you need
+- [Building a Desktop LLM App](llm-app/) — A hands-on guide to building a desktop app with llama.cpp, step by step

docs-src/pages/en/llm-app/index.md

@@ -0,0 +1,22 @@
+---
+title: "Building a Desktop LLM App with cpp-httplib"
+order: 0
+---
+
+Build an LLM-powered translation desktop app step by step, learning both the server and client sides of cpp-httplib along the way. Translation is just an example — swap it out to build your own summarizer, code generator, chatbot, or any other LLM application.
+
+## Dependencies
+
+- [llama.cpp](https://github.com/ggml-org/llama.cpp) — LLM inference engine
+- [nlohmann/json](https://github.com/nlohmann/json) — JSON parser (header-only)
+- [webview/webview](https://github.com/webview/webview) — WebView wrapper (header-only)
+- [cpp-httplib](https://github.com/yhirose/cpp-httplib) — HTTP server/client (header-only)
+
+## Chapters
+
+1. **Embed llama.cpp and create a REST API** — Start with a simple API that accepts text via POST and returns a translation as JSON
+2. **Add token streaming with SSE** — Stream translation results token by token using the standard LLM API approach
+3. **Add model discovery and download** — Use the client to search and download GGUF models from Hugging Face
+4. **Add a Web UI** — Serve a translation UI with static file hosting, making the app accessible from a browser
+5. **Turn it into a desktop app with WebView** — Wrap the web app with webview/webview to create an Electron-like desktop application
+6. **Code reading: llama.cpp's server implementation** — Compare your implementation with production-quality code and learn from the differences

docs-src/pages/en/tour/01-getting-started.md

@@ -0,0 +1,88 @@
+---
+title: "Getting Started"
+order: 1
+---
+
+All you need to get started with cpp-httplib is `httplib.h` and a C++ compiler. Let's download the file and get a Hello World server running.
+
+## Getting httplib.h
+
+You can download it directly from GitHub. Always use the latest version.
+
+```sh
+curl -LO https://github.com/yhirose/cpp-httplib/raw/refs/tags/latest/httplib.h
+```
+
+Place the downloaded `httplib.h` in your project directory and you're good to go.
+
+## Setting Up Your Compiler
+
+| OS | Development Environment | Setup |
+| -- | ----------------------- | ----- |
+| macOS | Apple Clang | Xcode Command Line Tools (`xcode-select --install`) |
+| Ubuntu | clang++ or g++ | `apt install clang` or `apt install g++` |
+| Windows | MSVC | Visual Studio 2022 or later (install with C++ components) |
+
+## Hello World Server
+
+Save the following code as `server.cpp`.
+
+```cpp
+#include "httplib.h"
+
+int main() {
+    httplib::Server svr;
+
+    svr.Get("/", [](const httplib::Request&, httplib::Response& res) {
+        res.set_content("Hello, World!", "text/plain");
+    });
+
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+In just a few lines, you have a server that responds to HTTP requests.
+
+## Compiling and Running
+
+The sample code in this tutorial is written in C++17 for cleaner, more concise code. cpp-httplib itself can compile with C++11 as well.
+
+```sh
+# macOS
+clang++ -std=c++17 -o server server.cpp
+
+# Linux
+# `-pthread`: cpp-httplib uses threads internally
+clang++ -std=c++17 -pthread -o server server.cpp
+
+# Windows (Developer Command Prompt)
+# `/EHsc`: Enable C++ exception handling
+cl /EHsc /std:c++17 server.cpp
+```
+
+Once it compiles, run it.
+
+```sh
+# macOS / Linux
+./server
+
+# Windows
+server.exe
+```
+
+Open `http://localhost:8080` in your browser. If you see "Hello, World!", you're all set.
+
+You can also verify with `curl`.
+
+```sh
+curl http://localhost:8080/
+# Hello, World!
+```
+
+To stop the server, press `Ctrl+C` in your terminal.
+
+## Next Steps
+
+Now you know the basics of running a server. Next, let's look at the client side. cpp-httplib also comes with HTTP client functionality.
+
+**Next:** [Basic Client](../02-basic-client)

docs-src/pages/en/tour/02-basic-client.md

@@ -0,0 +1,266 @@
+---
+title: "Basic Client"
+order: 2
+---
+
+cpp-httplib isn't just for servers -- it also comes with a full HTTP client. Let's use `httplib::Client` to send GET and POST requests.
+
+## Preparing a Test Server
+
+To try out the client, you need a server that accepts requests. Save the following code, then compile and run it the same way you did in the previous chapter. We'll cover the server details in the next chapter.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.Get("/hi", [](const auto &, auto &res) {
+        res.set_content("Hello!", "text/plain");
+    });
+
+    svr.Get("/search", [](const auto &req, auto &res) {
+        auto q = req.get_param_value("q");
+        res.set_content("Query: " + q, "text/plain");
+    });
+
+    svr.Post("/post", [](const auto &req, auto &res) {
+        res.set_content(req.body, "text/plain");
+    });
+
+    svr.Post("/submit", [](const auto &req, auto &res) {
+        std::string result;
+        for (auto &[key, val] : req.params) {
+            result += key + " = " + val + "\n";
+        }
+        res.set_content(result, "text/plain");
+    });
+
+    svr.Post("/upload", [](const auto &req, auto &res) {
+        auto f = req.form.get_file("file");
+        auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+        res.set_content(content, "text/plain");
+    });
+
+    svr.Get("/users/:id", [](const auto &req, auto &res) {
+        auto id = req.path_params.at("id");
+        res.set_content("User ID: " + id, "text/plain");
+    });
+
+    svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+        auto id = req.matches[1];
+        res.set_content("File ID: " + std::string(id), "text/plain");
+    });
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+## GET Request
+
+Once the server is running, open a separate terminal and give it a try. Let's start with the simplest GET request.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://localhost:8080");
+
+    auto res = cli.Get("/hi");
+    if (res) {
+        std::cout << res->status << std::endl;  // 200
+        std::cout << res->body << std::endl;    // Hello!
+    }
+}
+```
+
+Pass the server address to the `httplib::Client` constructor, then call `Get()` to send a request. You can retrieve the status code and body from the returned `res`.
+
+Here's the equivalent `curl` command.
+
+```sh
+curl http://localhost:8080/hi
+# Hello!
+```
+
+## Checking the Response
+
+A response contains header information in addition to the status code and body.
+
+```cpp
+auto res = cli.Get("/hi");
+if (res) {
+    // Status code
+    std::cout << res->status << std::endl;  // 200
+
+    // Body
+    std::cout << res->body << std::endl;  // Hello!
+
+    // Headers
+    std::cout << res->get_header_value("Content-Type") << std::endl;  // text/plain
+}
+```
+
+`res->body` is a `std::string`, so if you want to parse a JSON response, you can pass it directly to a JSON library like [nlohmann/json](https://github.com/nlohmann/json).
+
+## Query Parameters
+
+To add query parameters to a GET request, you can either write them directly in the URL or use `httplib::Params`.
+
+```cpp
+auto res = cli.Get("/search", httplib::Params{{"q", "cpp-httplib"}});
+if (res) {
+    std::cout << res->body << std::endl;  // Query: cpp-httplib
+}
+```
+
+`httplib::Params` automatically URL-encodes special characters for you.
+
+```sh
+curl "http://localhost:8080/search?q=cpp-httplib"
+# Query: cpp-httplib
+```
+
+## Path Parameters
+
+When values are embedded directly in the URL path, no special client API is needed. Just pass the path to `Get()` as-is.
+
+```cpp
+auto res = cli.Get("/users/42");
+if (res) {
+    std::cout << res->body << std::endl;  // User ID: 42
+}
+```
+
+```sh
+curl http://localhost:8080/users/42
+# User ID: 42
+```
+
+The test server also has a `/files/(\d+)` route that uses a regex to accept numeric IDs only.
+
+```cpp
+auto res = cli.Get("/files/42");
+if (res) {
+    std::cout << res->body << std::endl;  // File ID: 42
+}
+```
+
+```sh
+curl http://localhost:8080/files/42
+# File ID: 42
+```
+
+Pass a non-numeric ID like `/files/abc` and you'll get a 404. We'll cover how that works in the next chapter.
+
+## Request Headers
+
+To add custom HTTP headers, pass an `httplib::Headers` object. This works with both `Get()` and `Post()`.
+
+```cpp
+auto res = cli.Get("/hi", httplib::Headers{
+    {"Authorization", "Bearer my-token"}
+});
+```
+
+```sh
+curl -H "Authorization: Bearer my-token" http://localhost:8080/hi
+```
+
+## POST Request
+
+Let's POST some text data. Pass the body as the second argument to `Post()` and the Content-Type as the third.
+
+```cpp
+auto res = cli.Post("/post", "Hello, Server!", "text/plain");
+if (res) {
+    std::cout << res->status << std::endl;  // 200
+    std::cout << res->body << std::endl;    // Hello, Server!
+}
+```
+
+The test server's `/post` endpoint echoes the body back, so you get the same string you sent.
+
+```sh
+curl -X POST -H "Content-Type: text/plain" -d "Hello, Server!" http://localhost:8080/post
+# Hello, Server!
+```
+
+## Sending Form Data
+
+You can send key-value pairs just like an HTML form. Use `httplib::Params` for this.
+
+```cpp
+auto res = cli.Post("/submit", httplib::Params{
+    {"name", "Alice"},
+    {"age", "30"}
+});
+if (res) {
+    std::cout << res->body << std::endl;
+    // age = 30
+    // name = Alice
+}
+```
+
+This sends the data in `application/x-www-form-urlencoded` format.
+
+```sh
+curl -X POST -d "name=Alice&age=30" http://localhost:8080/submit
+```
+
+## POSTing a File
+
+To upload a file, use `httplib::UploadFormDataItems` to send it as multipart form data.
+
+```cpp
+auto res = cli.Post("/upload", httplib::UploadFormDataItems{
+    {"file", "Hello, File!", "hello.txt", "text/plain"}
+});
+if (res) {
+    std::cout << res->body << std::endl;  // hello.txt (12 bytes)
+}
+```
+
+Each element in `UploadFormDataItems` has four fields: `{name, content, filename, content_type}`.
+
+```sh
+curl -F "file=Hello, File!;filename=hello.txt;type=text/plain" http://localhost:8080/upload
+```
+
+## Error Handling
+
+Network communication can fail -- the server might not be reachable. Always check whether `res` is valid.
+
+```cpp
+httplib::Client cli("http://localhost:9999");  // Non-existent port
+auto res = cli.Get("/hi");
+
+if (!res) {
+    // Connection error
+    std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    // Error: Connection
+    return 1;
+}
+
+// If we reach here, we have a response
+if (res->status != 200) {
+    std::cout << "HTTP Error: " << res->status << std::endl;
+    return 1;
+}
+
+std::cout << res->body << std::endl;
+```
+
+There are two levels of errors.
+
+- **Connection error**: The client couldn't reach the server. `res` evaluates to false, and you can call `res.error()` to find out what went wrong.
+- **HTTP error**: The server returned an error status (404, 500, etc.). `res` evaluates to true, but you need to check `res->status`.
+
+## Next Steps
+
+Now you know how to send requests from a client. Next, let's take a closer look at the server side. We'll dig into routing, path parameters, and more.
+
+**Next:** [Basic Server](../03-basic-server)

docs-src/pages/en/tour/03-basic-server.md

@@ -0,0 +1,280 @@
+---
+title: "Basic Server"
+order: 3
+---
+
+In the previous chapter, you sent requests from a client to a test server. Now let's walk through how that server actually works.
+
+## Starting the Server
+
+Once you've registered your routes, call `svr.listen()` to start the server.
+
+```cpp
+svr.listen("0.0.0.0", 8080);
+```
+
+The first argument is the host, and the second is the port. `"0.0.0.0"` listens on all network interfaces. Use `"127.0.0.1"` if you want to accept connections from your own machine only.
+
+`listen()` is a blocking call. It won't return until the server stops. The server keeps running until you press `Ctrl+C` in your terminal or call `svr.stop()` from another thread.
+
+## Routing
+
+Routing is the heart of any server. It's how you tell cpp-httplib: when a request comes in for this URL with this HTTP method, run this code.
+
+```cpp
+httplib::Server svr;
+
+svr.Get("/hi", [](const httplib::Request &req, httplib::Response &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+`svr.Get()` registers a handler for GET requests. The first argument is the path, the second is the handler function. When a GET request arrives at `/hi`, your lambda runs.
+
+There's a method for each HTTP verb.
+
+```cpp
+svr.Get("/path",    handler);  // GET
+svr.Post("/path",   handler);  // POST
+svr.Put("/path",    handler);  // PUT
+svr.Delete("/path", handler);  // DELETE
+```
+
+The handler signature is `(const httplib::Request &req, httplib::Response &res)`. You can use `auto` to keep it short.
+
+```cpp
+svr.Get("/hi", [](const auto &req, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+The handler only runs when the path matches. Requests to unregistered paths automatically return 404.
+
+## The Request Object
+
+The first parameter `req` gives you everything the client sent.
+
+### Body
+
+`req.body` holds the request body as a `std::string`.
+
+```cpp
+svr.Post("/post", [](const auto &req, auto &res) {
+    // Echo the body back to the client
+    res.set_content(req.body, "text/plain");
+});
+```
+
+### Headers
+
+Use `req.get_header_value()` to read a request header.
+
+```cpp
+svr.Get("/check", [](const auto &req, auto &res) {
+    auto auth = req.get_header_value("Authorization");
+    res.set_content("Auth: " + auth, "text/plain");
+});
+```
+
+### Query Parameters and Form Data
+
+`req.get_param_value()` retrieves a parameter by name. It works for both GET query parameters and POST form data.
+
+```cpp
+svr.Get("/search", [](const auto &req, auto &res) {
+    auto q = req.get_param_value("q");
+    res.set_content("Query: " + q, "text/plain");
+});
+```
+
+A request to `/search?q=cpp-httplib` gives you `"cpp-httplib"` for `q`.
+
+To loop over all parameters, use `req.params`.
+
+```cpp
+svr.Post("/submit", [](const auto &req, auto &res) {
+    std::string result;
+    for (auto &[key, val] : req.params) {
+        result += key + " = " + val + "\n";
+    }
+    res.set_content(result, "text/plain");
+});
+```
+
+### File Uploads
+
+Files uploaded via multipart form data are available through `req.form.get_file()`.
+
+```cpp
+svr.Post("/upload", [](const auto &req, auto &res) {
+    auto f = req.form.get_file("file");
+    auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+    res.set_content(content, "text/plain");
+});
+```
+
+`f.filename` gives you the filename, and `f.content` gives you the file data.
+
+## Path Parameters
+
+Sometimes you want to capture part of the URL as a variable -- for example, the `42` in `/users/42`. Use the `:param` syntax to do that.
+
+```cpp
+svr.Get("/users/:id", [](const auto &req, auto &res) {
+    auto id = req.path_params.at("id");
+    res.set_content("User ID: " + id, "text/plain");
+});
+```
+
+A request to `/users/42` gives you `"42"` from `req.path_params.at("id")`. `/users/100` gives you `"100"`.
+
+You can capture multiple segments at once.
+
+```cpp
+svr.Get("/users/:user_id/posts/:post_id", [](const auto &req, auto &res) {
+    auto user_id = req.path_params.at("user_id");
+    auto post_id = req.path_params.at("post_id");
+    res.set_content("User: " + user_id + ", Post: " + post_id, "text/plain");
+});
+```
+
+### Regex Patterns
+
+You can also write a regular expression directly in the path instead of `:param`. Capture group values are available via `req.matches`, which is a `std::smatch`.
+
+```cpp
+// Only accept numeric IDs
+svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+    auto id = req.matches[1];  // First capture group
+    res.set_content("File ID: " + std::string(id), "text/plain");
+});
+```
+
+`/files/42` matches, but `/files/abc` doesn't. This is handy when you want to constrain what values are accepted.
+
+## Building a Response
+
+The second parameter `res` is how you send data back to the client.
+
+### Body and Content-Type
+
+`res.set_content()` sets the body and Content-Type. That's all you need for a 200 response.
+
+```cpp
+svr.Get("/hi", [](const auto &req, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+### Status Code
+
+To return a different status code, assign to `res.status`.
+
+```cpp
+svr.Get("/not-found", [](const auto &req, auto &res) {
+    res.status = 404;
+    res.set_content("Not found", "text/plain");
+});
+```
+
+### Response Headers
+
+Add response headers with `res.set_header()`.
+
+```cpp
+svr.Get("/with-header", [](const auto &req, auto &res) {
+    res.set_header("X-Custom", "my-value");
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+## Walking Through the Test Server
+
+Now let's use what we've learned to read through the test server from the previous chapter.
+
+### GET /hi
+
+```cpp
+svr.Get("/hi", [](const auto &, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+The simplest possible handler. We don't need any information from the request, so the `req` parameter is left unnamed. It just returns `"Hello!"`.
+
+### GET /search
+
+```cpp
+svr.Get("/search", [](const auto &req, auto &res) {
+    auto q = req.get_param_value("q");
+    res.set_content("Query: " + q, "text/plain");
+});
+```
+
+`req.get_param_value("q")` pulls out the query parameter `q`. A request to `/search?q=cpp-httplib` returns `"Query: cpp-httplib"`.
+
+### POST /post
+
+```cpp
+svr.Post("/post", [](const auto &req, auto &res) {
+    res.set_content(req.body, "text/plain");
+});
+```
+
+An echo server. Whatever body the client sends, `req.body` holds it, and we send it straight back.
+
+### POST /submit
+
+```cpp
+svr.Post("/submit", [](const auto &req, auto &res) {
+    std::string result;
+    for (auto &[key, val] : req.params) {
+        result += key + " = " + val + "\n";
+    }
+    res.set_content(result, "text/plain");
+});
+```
+
+Loops over the form data in `req.params` using structured bindings (`auto &[key, val]`) to unpack each key-value pair.
+
+### POST /upload
+
+```cpp
+svr.Post("/upload", [](const auto &req, auto &res) {
+    auto f = req.form.get_file("file");
+    auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+    res.set_content(content, "text/plain");
+});
+```
+
+Receives a file uploaded via multipart form data. `req.form.get_file("file")` fetches the field named `"file"`, and we respond with the filename and size.
+
+### GET /users/:id
+
+```cpp
+svr.Get("/users/:id", [](const auto &req, auto &res) {
+    auto id = req.path_params.at("id");
+    res.set_content("User ID: " + id, "text/plain");
+});
+```
+
+`:id` is the path parameter. `req.path_params.at("id")` retrieves its value. `/users/42` gives you `"42"`, `/users/alice` gives you `"alice"`.
+
+### GET /files/(\d+)
+
+```cpp
+svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+    auto id = req.matches[1];
+    res.set_content("File ID: " + std::string(id), "text/plain");
+});
+```
+
+The regex `(\d+)` matches numeric IDs only. `/files/42` hits this handler, but `/files/abc` returns 404. `req.matches[1]` retrieves the first capture group.
+
+## Next Steps
+
+You now have the full picture of how a server works. Routing, reading requests, building responses -- that's enough to build a real API server.
+
+Next, let's look at serving static files. We'll build a server that delivers HTML and CSS.
+
+**Next:** [Static File Server](../04-static-file-server)

docs-src/pages/en/tour/04-static-file-server.md

@@ -0,0 +1,134 @@
+---
+title: "Static File Server"
+order: 4
+---
+
+cpp-httplib can serve static files too — HTML, CSS, images, you name it. No complicated configuration required. One call to `set_mount_point()` is all it takes.
+
+## The basics of set_mount_point
+
+Let's jump right in. `set_mount_point()` maps a URL path to a local directory.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.set_mount_point("/", "./html");
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+The first argument is the URL mount point. The second is the local directory path. In this example, requests to `/` are served from the `./html` directory.
+
+Let's try it out. First, create an `html` directory and add an `index.html` file.
+
+```sh
+mkdir html
+```
+
+```html
+<!DOCTYPE html>
+<html>
+<head><title>My Page</title></head>
+<body>
+    <h1>Hello from cpp-httplib!</h1>
+    <p>This is a static file.</p>
+</body>
+</html>
+```
+
+Compile and start the server.
+
+```sh
+g++ -std=c++17 -o server server.cpp -pthread
+./server
+```
+
+Open `http://localhost:8080` in your browser. You should see the contents of `html/index.html`. Visiting `http://localhost:8080/index.html` returns the same page.
+
+You can also access it with the client code from the previous chapter, or with `curl`.
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+auto res = cli.Get("/");
+if (res) {
+    std::cout << res->body << std::endl;  // HTML is displayed
+}
+```
+
+```sh
+curl http://localhost:8080
+```
+
+## Multiple mount points
+
+You can call `set_mount_point()` as many times as you like. Each URL path gets its own directory.
+
+```cpp
+svr.set_mount_point("/", "./public");
+svr.set_mount_point("/assets", "./static/assets");
+svr.set_mount_point("/docs", "./documentation");
+```
+
+A request to `/assets/style.css` serves `./static/assets/style.css`. A request to `/docs/guide.html` serves `./documentation/guide.html`.
+
+## Combining with handlers
+
+Static file serving and routing handlers — the kind you learned about in the previous chapter — work side by side.
+
+```cpp
+httplib::Server svr;
+
+// API endpoint
+svr.Get("/api/hello", [](const auto &, auto &res) {
+    res.set_content(R"({"message":"Hello!"})", "application/json");
+});
+
+// Static file serving
+svr.set_mount_point("/", "./public");
+
+svr.listen("0.0.0.0", 8080);
+```
+
+Handlers take priority. The handler responds to `/api/hello`. For every other path, the server looks for a file in `./public`.
+
+## Adding response headers
+
+Pass headers as the third argument to `set_mount_point()` and they get attached to every static file response. This is great for cache control.
+
+```cpp
+svr.set_mount_point("/", "./public", {
+    {"Cache-Control", "max-age=3600"}
+});
+```
+
+With this in place, the browser caches served files for one hour.
+
+## A Dockerfile for your static file server
+
+The cpp-httplib repository includes a `Dockerfile` built for static file serving. We also publish a pre-built image on Docker Hub, so you can get up and running with a single command.
+
+```sh
+> docker run -p 8080:80 -v ./my-site:/html yhirose4dockerhub/cpp-httplib-server
+Serving HTTP on 0.0.0.0:80
+Mount point: / -> ./html
+Press Ctrl+C to shutdown gracefully...
+192.168.65.1 - - [22/Feb/2026:12:00:00 +0000] "GET / HTTP/1.1" 200 256 "-" "Mozilla/5.0 ..."
+192.168.65.1 - - [22/Feb/2026:12:00:00 +0000] "GET /style.css HTTP/1.1" 200 1024 "-" "Mozilla/5.0 ..."
+192.168.65.1 - - [22/Feb/2026:12:00:01 +0000] "GET /favicon.ico HTTP/1.1" 404 152 "-" "Mozilla/5.0 ..."
+```
+
+Everything in your `./my-site` directory gets served on port 8080. The access log follows the same format as NGINX, so you can see exactly what's happening.
+
+## What's next
+
+You can now serve static files. A web server that delivers HTML, CSS, and JavaScript — built with this little code.
+
+Next, let's encrypt your connections with HTTPS. We'll start by setting up a TLS library.
+
+**Next:** [TLS Setup](../05-tls-setup)

docs-src/pages/en/tour/05-tls-setup.md

@@ -0,0 +1,88 @@
+---
+title: "TLS Setup"
+order: 5
+---
+
+So far we've been using plain HTTP, but in the real world, HTTPS is the norm. To use HTTPS with cpp-httplib, you need a TLS library.
+
+In this tour, we'll use OpenSSL. It's the most widely used option, and you'll find plenty of resources online.
+
+## Installing OpenSSL
+
+Install it for your OS.
+
+| OS | How to install |
+| -- | -------------- |
+| macOS | [Homebrew](https://brew.sh/) (`brew install openssl`) |
+| Ubuntu / Debian | `sudo apt install libssl-dev` |
+| Windows | [vcpkg](https://vcpkg.io/) (`vcpkg install openssl`) |
+
+## Compile Options
+
+To enable TLS, define the `CPPHTTPLIB_OPENSSL_SUPPORT` macro when compiling. You'll need a few extra options compared to the previous chapters.
+
+```sh
+# macOS (Homebrew)
+clang++ -std=c++17 -DCPPHTTPLIB_OPENSSL_SUPPORT \
+    -I$(brew --prefix openssl)/include \
+    -L$(brew --prefix openssl)/lib \
+    -lssl -lcrypto \
+    -framework CoreFoundation -framework Security \
+    -o server server.cpp
+
+# Linux
+clang++ -std=c++17 -pthread -DCPPHTTPLIB_OPENSSL_SUPPORT \
+    -lssl -lcrypto \
+    -o server server.cpp
+
+# Windows (Developer Command Prompt)
+cl /EHsc /std:c++17 /DCPPHTTPLIB_OPENSSL_SUPPORT server.cpp libssl.lib libcrypto.lib
+```
+
+Let's look at what each option does.
+
+- **`-DCPPHTTPLIB_OPENSSL_SUPPORT`** — Defines the macro that enables TLS support
+- **`-lssl -lcrypto`** — Links the OpenSSL libraries
+- **`-I` / `-L`** (macOS only) — Points to the Homebrew OpenSSL paths
+- **`-framework CoreFoundation -framework Security`** (macOS only) — Needed to automatically load system certificates from the Keychain
+
+## Verifying the Setup
+
+Let's make sure everything works. Here's a simple program that passes an HTTPS URL to `httplib::Client`.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://www.google.com");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << "Status: " << res->status << std::endl;
+    } else {
+        std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    }
+}
+```
+
+Compile and run it. If you see `Status: 200`, your setup is complete.
+
+## Other TLS Backends
+
+cpp-httplib also supports Mbed TLS and wolfSSL in addition to OpenSSL. You can switch between them just by changing the macro definition and linked libraries.
+
+| Backend | Macro | Libraries to link |
+| :--- | :--- | :--- |
+| OpenSSL | `CPPHTTPLIB_OPENSSL_SUPPORT` | `libssl`, `libcrypto` |
+| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` |
+| wolfSSL | `CPPHTTPLIB_WOLFSSL_SUPPORT` | `libwolfssl` |
+
+This tour assumes OpenSSL, but the API is the same regardless of which backend you choose.
+
+## Next Step
+
+You're all set with TLS. Next, let's send a request to an HTTPS site.
+
+**Next:** [HTTPS Client](../06-https-client)

docs-src/pages/en/tour/06-https-client.md

@@ -0,0 +1,122 @@
+---
+title: "HTTPS Client"
+order: 6
+---
+
+In the previous chapter, you set up OpenSSL. Now let's put it to use with an HTTPS client. You can use the same `httplib::Client` from Chapter 2. Just pass a URL with the `https://` scheme to the constructor.
+
+## GET Request
+
+Let's try accessing a real HTTPS site.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://nghttp2.org");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->status << std::endl;           // 200
+        std::cout << res->body.substr(0, 100) << std::endl;  // First 100 chars of the HTML
+    } else {
+        std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    }
+}
+```
+
+In Chapter 2, you wrote `httplib::Client cli("http://localhost:8080")`. All you need to change is the scheme to `https://`. Every API you learned in Chapter 2 -- `Get()`, `Post()`, and so on -- works exactly the same way.
+
+```sh
+curl https://nghttp2.org/
+```
+
+## Specifying a Port
+
+The default port for HTTPS is 443. If you need a different port, include it in the URL.
+
+```cpp
+httplib::Client cli("https://localhost:8443");
+```
+
+## CA Certificate Verification
+
+When connecting over HTTPS, `httplib::Client` verifies the server certificate by default. It only connects to servers whose certificate was issued by a trusted CA (Certificate Authority).
+
+CA certificates are loaded automatically from the Keychain on macOS, the system CA certificate store on Linux, and the Windows certificate store on Windows. In most cases, no extra configuration is needed.
+
+### Specifying a CA Certificate File
+
+On some environments, the system CA certificates may not be found. In that case, use `set_ca_cert_path()` to specify the path directly.
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+cli.set_ca_cert_path("/etc/ssl/certs/ca-certificates.crt");
+
+auto res = cli.Get("/");
+```
+
+```sh
+curl --cacert /etc/ssl/certs/ca-certificates.crt https://nghttp2.org/
+```
+
+### Disabling Certificate Verification
+
+During development, you might want to connect to a server with a self-signed certificate. You can disable verification for that.
+
+```cpp
+httplib::Client cli("https://localhost:8443");
+cli.enable_server_certificate_verification(false);
+
+auto res = cli.Get("/");
+```
+
+```sh
+curl -k https://localhost:8443/
+```
+
+Never disable this in production. It opens you up to man-in-the-middle attacks.
+
+## Following Redirects
+
+When accessing HTTPS sites, you'll often encounter redirects. For example, `http://` to `https://`, or a bare domain to `www`.
+
+By default, redirects are not followed. You can check the redirect target in the `Location` header.
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+
+auto res = cli.Get("/httpbin/redirect/3");
+if (res) {
+    std::cout << res->status << std::endl;  // 302
+    std::cout << res->get_header_value("Location") << std::endl;
+}
+```
+
+```sh
+curl https://nghttp2.org/httpbin/redirect/3
+```
+
+Call `set_follow_location(true)` to automatically follow redirects and get the final response.
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+cli.set_follow_location(true);
+
+auto res = cli.Get("/httpbin/redirect/3");
+if (res) {
+    std::cout << res->status << std::endl;  // 200 (the final response)
+}
+```
+
+```sh
+curl -L https://nghttp2.org/httpbin/redirect/3
+```
+
+## Next Steps
+
+Now you know how to use the HTTPS client. Next, let's set up your own HTTPS server. We'll start with creating a self-signed certificate.
+
+**Next:** [HTTPS Server](../07-https-server)

docs-src/pages/en/tour/07-https-server.md

@@ -0,0 +1,124 @@
+---
+title: "HTTPS Server"
+order: 7
+---
+
+In the previous chapter, you used an HTTPS client. Now let's set up your own HTTPS server. Just swap `httplib::Server` from Chapter 3 with `httplib::SSLServer`.
+
+A TLS server needs a server certificate and a private key, though. Let's get those ready first.
+
+## Creating a Self-Signed Certificate
+
+For development and testing, a self-signed certificate works just fine. You can generate one quickly with an OpenSSL command.
+
+```sh
+openssl req -x509 -noenc -keyout key.pem -out cert.pem -subj /CN=localhost
+```
+
+This creates two files:
+
+- **`cert.pem`** — Server certificate
+- **`key.pem`** — Private key
+
+## A Minimal HTTPS Server
+
+Once you have your certificate, let's write the server.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::SSLServer svr("cert.pem", "key.pem");
+
+    svr.Get("/", [](const auto &, auto &res) {
+        res.set_content("Hello, HTTPS!", "text/plain");
+    });
+
+    std::cout << "Listening on https://localhost:8443" << std::endl;
+    svr.listen("0.0.0.0", 8443);
+}
+```
+
+Just pass the certificate and private key paths to the `httplib::SSLServer` constructor. The routing API is exactly the same as `httplib::Server` from Chapter 3.
+
+Compile and start it up.
+
+## Testing It Out
+
+With the server running, try accessing it with `curl`. Since we're using a self-signed certificate, add the `-k` option to skip certificate verification.
+
+```sh
+curl -k https://localhost:8443/
+# Hello, HTTPS!
+```
+
+If you open `https://localhost:8443` in a browser, you'll see a "This connection is not secure" warning. That's expected with a self-signed certificate. Just proceed past it.
+
+## Connecting from a Client
+
+Let's connect using `httplib::Client` from the previous chapter. There are two ways to connect to a server with a self-signed certificate.
+
+### Option 1: Disable Certificate Verification
+
+This is the quick and easy approach for development.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://localhost:8443");
+    cli.enable_server_certificate_verification(false);
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->body << std::endl;  // Hello, HTTPS!
+    }
+}
+```
+
+### Option 2: Specify the Self-Signed Certificate as a CA Certificate
+
+This is the safer approach. You tell the client to trust `cert.pem` as a CA certificate.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://localhost:8443");
+    cli.set_ca_cert_path("cert.pem");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->body << std::endl;  // Hello, HTTPS!
+    }
+}
+```
+
+This way, only connections to the server with that specific certificate are allowed, preventing impersonation. Use this approach whenever possible, even in test environments.
+
+## Comparing Server and SSLServer
+
+The `httplib::Server` API you learned in Chapter 3 works exactly the same with `httplib::SSLServer`. The only difference is the constructor.
+
+| | `httplib::Server` | `httplib::SSLServer` |
+| -- | ------------------ | -------------------- |
+| Constructor | No arguments | Certificate and private key paths |
+| Protocol | HTTP | HTTPS |
+| Port (convention) | 8080 | 8443 |
+| Routing | Same | Same |
+
+To switch an HTTP server to HTTPS, just change the constructor.
+
+## Next Steps
+
+Your HTTPS server is up and running. You now have the basics of both HTTP/HTTPS clients and servers covered.
+
+Next, let's look at the WebSocket support that was recently added to cpp-httplib.
+
+**Next:** [WebSocket](../08-websocket)

docs-src/pages/en/tour/08-websocket.md

@@ -0,0 +1,139 @@
+---
+title: "WebSocket"
+order: 8
+---
+
+cpp-httplib supports WebSocket as well. Unlike HTTP request/response, WebSocket lets the server and client exchange messages in both directions. It's great for chat apps and real-time notifications.
+
+Let's build an echo server and client right away.
+
+## Echo Server
+
+Here's an echo server that sends back whatever message it receives.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+        std::string msg;
+        while (ws.read(msg)) {
+            ws.send(msg);  // Send back the received message as-is
+        }
+    });
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+You register a WebSocket handler with `svr.WebSocket()`. It works just like `svr.Get()` and `svr.Post()` from Chapter 3.
+
+Inside the handler, `ws.read(msg)` waits for a message. When the connection closes, `read()` returns `false`, so the loop exits. `ws.send(msg)` sends a message back.
+
+## Connecting from a Client
+
+Let's connect to the server using `httplib::ws::WebSocketClient`.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::ws::WebSocketClient client("ws://localhost:8080/ws");
+
+    if (!client.connect()) {
+        std::cout << "Connection failed" << std::endl;
+        return 1;
+    }
+
+    // Send a message
+    client.send("Hello, WebSocket!");
+
+    // Receive a response from the server
+    std::string msg;
+    if (client.read(msg)) {
+        std::cout << msg << std::endl;  // Hello, WebSocket!
+    }
+
+    client.close();
+}
+```
+
+Pass a URL in `ws://host:port/path` format to the constructor. Call `connect()` to start the connection, then use `send()` and `read()` to exchange messages.
+
+## Text and Binary
+
+WebSocket has two types of messages: text and binary. You can tell them apart by the return value of `read()`.
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    httplib::ws::ReadResult ret;
+    while ((ret = ws.read(msg))) {
+        if (ret == httplib::ws::Binary) {
+            ws.send(msg.data(), msg.size());  // Send as binary
+        } else {
+            ws.send(msg);  // Send as text
+        }
+    }
+});
+```
+
+- `ws.send(const std::string &)` — sends as a text message
+- `ws.send(const char *, size_t)` — sends as a binary message
+
+The client-side API is the same.
+
+## Accessing Request Information
+
+You can read HTTP request information from the handshake through the first argument `req` in the handler. This is handy for checking authentication tokens.
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    auto token = req.get_header_value("Authorization");
+    if (token.empty()) {
+        ws.close(httplib::ws::CloseStatus::PolicyViolation, "unauthorized");
+        return;
+    }
+
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send(msg);
+    }
+});
+```
+
+## Using WSS
+
+WebSocket over HTTPS (WSS) is also supported. On the server side, just register a WebSocket handler on `httplib::SSLServer`.
+
+```cpp
+httplib::SSLServer svr("cert.pem", "key.pem");
+
+svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send(msg);
+    }
+});
+
+svr.listen("0.0.0.0", 8443);
+```
+
+On the client side, use the `wss://` scheme.
+
+```cpp
+httplib::ws::WebSocketClient client("wss://localhost:8443/ws");
+```
+
+## Next Steps
+
+Now you know the basics of WebSocket. This wraps up the Tour.
+
+The next page gives you a summary of features we didn't cover in the Tour.
+
+**Next:** [What's Next](../09-whats-next)

docs-src/pages/en/tour/09-whats-next.md

@@ -0,0 +1,228 @@
+---
+title: "What's Next"
+order: 9
+---
+
+Great job finishing the Tour! You now have a solid grasp of the cpp-httplib basics. But there's a lot more to explore. Here's a quick overview of features we didn't cover in the Tour, organized by category.
+
+## Streaming API
+
+When you're working with LLM streaming responses or downloading large files, you don't want to load the entire response into memory. Use `stream::Get()` to process data chunk by chunk.
+
+```cpp
+httplib::Client cli("http://localhost:11434");
+
+auto result = httplib::stream::Get(cli, "/api/generate");
+
+if (result) {
+    while (result.next()) {
+        std::cout.write(result.data(), result.size());
+    }
+}
+```
+
+You can also pass a `content_receiver` callback to `Get()`. This approach works with Keep-Alive.
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+
+cli.Get("/stream", [](const char *data, size_t len) {
+    std::cout.write(data, len);
+    return true;
+});
+```
+
+On the server side, you have `set_content_provider()` and `set_chunked_content_provider()`. Use the former when you know the size, and the latter when you don't.
+
+```cpp
+// With known size (sets Content-Length)
+svr.Get("/file", [](const auto &, auto &res) {
+    auto size = get_file_size("large.bin");
+    res.set_content_provider(size, "application/octet-stream",
+        [](size_t offset, size_t length, httplib::DataSink &sink) {
+            // Send 'length' bytes starting from 'offset'
+            return true;
+        });
+});
+
+// Unknown size (Chunked Transfer Encoding)
+svr.Get("/stream", [](const auto &, auto &res) {
+    res.set_chunked_content_provider("text/plain",
+        [](size_t offset, httplib::DataSink &sink) {
+            sink.write("chunk\n", 6);
+            return true;  // Return false to finish
+        });
+});
+```
+
+For uploading large files, `make_file_provider()` comes in handy. It streams the file instead of loading it all into memory.
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+
+auto res = cli.Post("/upload", {}, {}, {
+    httplib::make_file_provider("file", "/path/to/large-file.zip")
+});
+```
+
+## Server-Sent Events (SSE)
+
+We provide an SSE client as well. It supports automatic reconnection and resuming via `Last-Event-ID`.
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << msg.event << ": " << msg.data << std::endl;
+});
+
+sse.start();  // Blocking, with auto-reconnection
+```
+
+You can also set separate handlers for each event type.
+
+```cpp
+sse.on_event("update", [](const httplib::sse::SSEMessage &msg) {
+    // Only handles "update" events
+});
+```
+
+## Authentication
+
+The client has helpers for Basic auth, Bearer Token auth, and Digest auth.
+
+```cpp
+httplib::Client cli("https://api.example.com");
+cli.set_basic_auth("user", "password");
+cli.set_bearer_token_auth("my-token");
+```
+
+## Compression
+
+We support compression and decompression with gzip, Brotli, and Zstandard. Define the corresponding macro when you compile.
+
+| Method | Macro |
+| -- | -- |
+| gzip | `CPPHTTPLIB_ZLIB_SUPPORT` |
+| Brotli | `CPPHTTPLIB_BROTLI_SUPPORT` |
+| Zstandard | `CPPHTTPLIB_ZSTD_SUPPORT` |
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_compress(true);    // Compress request body
+cli.set_decompress(true);  // Decompress response body
+```
+
+## Proxy
+
+You can connect through an HTTP proxy.
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_proxy("proxy.example.com", 8080);
+cli.set_proxy_basic_auth("user", "password");
+```
+
+## Timeouts
+
+You can set connection, read, and write timeouts individually.
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_connection_timeout(5, 0);  // 5 seconds
+cli.set_read_timeout(10, 0);       // 10 seconds
+cli.set_write_timeout(10, 0);      // 10 seconds
+```
+
+## Keep-Alive
+
+If you're making multiple requests to the same server, enable Keep-Alive. It reuses the TCP connection, which is much more efficient.
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_keep_alive(true);
+```
+
+## Server Middleware
+
+You can hook into request processing before and after handlers run.
+
+```cpp
+svr.set_pre_routing_handler([](const auto &req, auto &res) {
+    // Runs before every request
+    return httplib::Server::HandlerResponse::Unhandled;  // Continue to normal routing
+});
+
+svr.set_post_routing_handler([](const auto &req, auto &res) {
+    // Runs after the response is sent
+    res.set_header("X-Server", "cpp-httplib");
+});
+```
+
+Use `res.user_data` to pass data from middleware to handlers. This is useful for sharing things like decoded auth tokens.
+
+```cpp
+svr.set_pre_routing_handler([](const auto &req, auto &res) {
+    res.user_data["auth_user"] = std::string("alice");
+    return httplib::Server::HandlerResponse::Unhandled;
+});
+
+svr.Get("/me", [](const auto &req, auto &res) {
+    auto user = std::any_cast<std::string>(res.user_data.at("auth_user"));
+    res.set_content("Hello, " + user, "text/plain");
+});
+```
+
+You can also customize error and exception handlers.
+
+```cpp
+svr.set_error_handler([](const auto &req, auto &res) {
+    res.set_content("Custom Error Page", "text/html");
+});
+
+svr.set_exception_handler([](const auto &req, auto &res, std::exception_ptr ep) {
+    res.status = 500;
+    res.set_content("Internal Server Error", "text/plain");
+});
+```
+
+## Logging
+
+You can set a logger on both the server and the client.
+
+```cpp
+svr.set_logger([](const auto &req, const auto &res) {
+    std::cout << req.method << " " << req.path << " " << res.status << std::endl;
+});
+```
+
+## Unix Domain Socket
+
+In addition to TCP, we support Unix Domain Sockets. You can use them for inter-process communication on the same machine.
+
+```cpp
+// Server
+httplib::Server svr;
+svr.set_address_family(AF_UNIX);
+svr.listen("/tmp/httplib.sock", 0);
+```
+
+```cpp
+// Client
+httplib::Client cli("http://localhost");
+cli.set_address_family(AF_UNIX);
+cli.set_hostname_addr_map({{"localhost", "/tmp/httplib.sock"}});
+
+auto res = cli.Get("/");
+```
+
+## Learn More
+
+Want to dig deeper? Check out these resources.
+
+- Cookbook — A collection of recipes for common use cases
+- [README](https://github.com/yhirose/cpp-httplib/blob/master/README.md) — Full API reference
+- [README-sse](https://github.com/yhirose/cpp-httplib/blob/master/README-sse.md) — How to use Server-Sent Events
+- [README-stream](https://github.com/yhirose/cpp-httplib/blob/master/README-stream.md) — How to use the Streaming API
+- [README-websocket](https://github.com/yhirose/cpp-httplib/blob/master/README-websocket.md) — How to use the WebSocket server

docs-src/pages/en/tour/index.md

@@ -0,0 +1,16 @@
+---
+title: "A Tour of cpp-httplib"
+order: 0
+---
+
+This is a step-by-step tutorial that walks you through the basics of cpp-httplib. Each chapter builds on the previous one, so please read them in order starting from Chapter 1.
+
+1. [Getting Started](01-getting-started) — Get httplib.h and build a Hello World server
+2. [Basic Client](02-basic-client) — Send GET/POST requests and use path parameters
+3. [Basic Server](03-basic-server) — Routing, path parameters, and building responses
+4. [Static File Server](04-static-file-server) — Serve static files
+5. [TLS Setup](05-tls-setup) — Set up OpenSSL / mbedTLS
+6. [HTTPS Client](06-https-client) — Make requests to HTTPS sites
+7. [HTTPS Server](07-https-server) — Build an HTTPS server
+8. [WebSocket](08-websocket) — Learn the basics of WebSocket communication
+9. [What's Next](09-whats-next) — Explore more features

docs-src/pages/ja/cookbook/index.md

@@ -0,0 +1,95 @@
+---
+title: "Cookbook"
+order: 0
+---
+
+「〇〇をするには？」という問いに答えるレシピ集です。各レシピは独立しているので、必要なページだけ読めます。
+
+## クライアント
+
+### 基本
+- レスポンスボディを文字列で取得する / ファイルに保存する
+- JSON を送受信する
+- デフォルトヘッダーを設定する（`set_default_headers`）
+- リダイレクトを追従する（`set_follow_location`）
+
+### 認証
+- Basic 認証を使う（`set_basic_auth`）
+- Bearer トークンで API を呼ぶ
+
+### ファイル送信
+- ファイルをマルチパートフォームとしてアップロードする（`make_file_provider`）
+- ファイルを生バイナリとして POST する（`make_file_body`）
+- チャンク転送でボディを送る（Content Provider）
+
+### ストリーミング・進捗
+- レスポンスをストリーミングで受信する
+- 進捗コールバックを使う（`DownloadProgress` / `UploadProgress`）
+
+### 接続・パフォーマンス
+- タイムアウトを設定する（`set_connection_timeout` / `set_read_timeout`）
+- 全体タイムアウトを設定する（`set_max_timeout`）
+- 接続の再利用と Keep-Alive の挙動を理解する
+- 圧縮を有効にする（`set_compress` / `set_decompress`）
+- プロキシを経由してリクエストを送る（`set_proxy`）
+
+### エラー処理・デバッグ
+- エラーコードをハンドリングする（`Result::error()`）
+- SSL エラーをハンドリングする（`ssl_error()` / `ssl_backend_error()`）
+- クライアントにログを設定する（`set_logger` / `set_error_logger`）
+
+## サーバー
+
+### 基本
+- GET / POST / PUT / DELETE ハンドラを登録する
+- JSON リクエストを受け取り JSON レスポンスを返す
+- パスパラメーターを使う（`/users/:id`）
+- 静的ファイルサーバーを設定する（`set_mount_point`）
+
+### ストリーミング・ファイル
+- 大きなファイルをストリーミングで返す（`ContentProvider`）
+- ファイルダウンロードレスポンスを返す（`Content-Disposition`）
+- マルチパートデータをストリーミングで受け取る（`ContentReader`）
+- レスポンスを圧縮して返す（gzip）
+
+### ハンドラチェーン
+- 全ルートに共通の前処理をする（Pre-routing handler）
+- Post-routing handler でレスポンスヘッダーを追加する（CORS など）
+- Pre-request handler でルート単位の認証を行う（`matched_route`）
+- `res.user_data` でハンドラ間データを渡す
+
+### エラー処理・デバッグ
+- カスタムエラーページを返す（`set_error_handler`）
+- 例外をキャッチする（`set_exception_handler`）
+- リクエストをログに記録する（Logger）
+- クライアントが切断したか検出する（`req.is_connection_closed()`）
+
+### 運用・チューニング
+- ポートを動的に割り当てる（`bind_to_any_port`）
+- `listen_after_bind` で起動順序を制御する
+- グレースフルシャットダウンする（`stop()` とシグナルハンドリング）
+- Keep-Alive を調整する（`set_keep_alive_max_count` / `set_keep_alive_timeout`）
+- マルチスレッド数を設定する（`new_task_queue`）
+
+## TLS / セキュリティ
+
+- OpenSSL・mbedTLS・wolfSSL の選択指針（ビルド時の `#define` の違い）
+- SSL 証明書の検証を制御する（証明書の無効化・カスタム CA・カスタムコールバック）
+- カスタム証明書検証コールバックを使う（`set_server_certificate_verifier`）
+- SSL/TLS サーバーを立ち上げる（証明書・秘密鍵の設定）
+- mTLS（クライアント証明書による相互認証）を設定する
+- サーバー側でピア証明書を参照する（`req.peer_cert()` / SNI）
+
+## SSE
+
+- SSE サーバーを実装する
+- SSE でイベント名を使い分ける
+- SSE の再接続を処理する（`Last-Event-ID`）
+- SSE をクライアントで受信する
+
+## WebSocket
+
+- WebSocket エコーサーバー／クライアントを実装する
+- ハートビートを設定する（`set_websocket_ping_interval` / `CPPHTTPLIB_WEBSOCKET_PING_INTERVAL_SECOND`）
+- 接続クローズをハンドリングする
+- バイナリフレームを送受信する

docs-src/pages/ja/index.md

@@ -0,0 +1,22 @@
+---
+title: "cpp-httplib"
+order: 0
+---
+
+[cpp-httplib](https://github.com/yhirose/cpp-httplib)は、C++用のHTTP/HTTPSライブラリです。[`httplib.h`](https://github.com/yhirose/cpp-httplib/raw/refs/tags/latest/httplib.h) というヘッダーファイルを1枚コピーするだけで使えます。
+
+C++でちょっとしたHTTPサーバーやクライアントが必要になったとき、すぐに動くものが欲しいですよね。cpp-httplibはまさにそのために作られました。サーバーもクライアントも、数行のコードで書き始められます。
+
+APIはラムダ式をベースにした直感的な設計で、C++11以降のコンパイラーがあればどこでも動きます。Windows、macOS、Linux — お使いの環境をそのまま使えます。
+
+HTTPSも使えます。OpenSSLやmbedTLSをリンクするだけで、サーバー・クライアントの両方がTLSに対応します。Content-Encoding（gzip, brotli等）、ファイルアップロードなど、実際の開発で必要になる機能もひと通り揃っています。WebSocketもサポートしています。
+
+内部的にはブロッキングI/Oとスレッドプールを使っています。大量の同時接続を捌くような用途には向きませんが、APIサーバーやツールの組み込みHTTP、テスト用のモックサーバーなど、多くのユースケースで十分な性能を発揮します。
+
+「今日の課題を、今日中に解決する」— cpp-httplibが目指しているのは、そういうシンプルさです。
+
+## ドキュメント
+
+- [A Tour of cpp-httplib](tour/) — 基本を順を追って学べるチュートリアル。初めての方はここから
+- [Cookbook](cookbook/) — 目的別のレシピ集。必要なトピックから読めます
+- [Building a Desktop LLM App](llm-app/) — llama.cpp を組み込んだデスクトップアプリを段階的に構築する実践ガイド

docs-src/pages/ja/llm-app/index.md

@@ -0,0 +1,22 @@
+---
+title: "Building a Desktop LLM App with cpp-httplib"
+order: 0
+---
+
+llama.cpp を組み込んだ LLM 翻訳デスクトップアプリを段階的に構築しながら、cpp-httplib のサーバー・クライアント両面の使い方を実践的に学びます。翻訳は一例であり、この部分を差し替えることで要約・コード生成・チャットボットなど自分のアプリに応用できます。
+
+## 依存ライブラリ
+
+- [llama.cpp](https://github.com/ggml-org/llama.cpp) — LLM 推論エンジン
+- [nlohmann/json](https://github.com/nlohmann/json) — JSON パーサー（ヘッダーオンリー）
+- [webview/webview](https://github.com/webview/webview) — WebView ラッパー（ヘッダーオンリー）
+- [cpp-httplib](https://github.com/yhirose/cpp-httplib) — HTTP サーバー/クライアント（ヘッダーオンリー）
+
+## 章立て
+
+1. **llama.cpp を組み込んで REST API を作る** — テキストを POST すると翻訳結果を JSON で返すシンプルな API から始める
+2. **SSE でトークンストリーミングを追加する** — 翻訳結果をトークン単位で逐次返す LLM API 標準の方式を実装する
+3. **モデルの取得・管理機能を追加する** — Hugging Face から GGUF モデルを検索・ダウンロードするクライアント機能を実装する
+4. **Web UI を追加する** — 静的ファイル配信で翻訳 UI をホストし、ブラウザから操作できるようにする
+5. **WebView でデスクトップアプリ化する** — webview/webview で包み、Electron 的なデスクトップアプリとして動作させる
+6. **llama.cpp 本家のサーバー実装をコードリーディング** — 自分で作ったものとプロダクション品質のコードを比較して学ぶ

docs-src/pages/ja/tour/01-getting-started.md

@@ -0,0 +1,88 @@
+---
+title: "Getting Started"
+order: 1
+---
+
+cpp-httplibを始めるのに必要なのは、`httplib.h`とC++コンパイラーだけです。ファイルをダウンロードして、Hello Worldサーバーを動かすところまでやってみましょう。
+
+## httplib.h の入手
+
+GitHubから直接ダウンロードできます。常に最新版を使ってください。
+
+```sh
+curl -LO https://github.com/yhirose/cpp-httplib/raw/refs/tags/latest/httplib.h
+```
+
+ダウンロードした `httplib.h` をプロジェクトのディレクトリに置けば、準備完了です。
+
+## コンパイラーの準備
+
+| OS | 開発環境 | セットアップ |
+| -- | -------- | ------------ |
+| macOS | Apple Clang | Xcode Command Line Tools (`xcode-select --install`) |
+| Ubuntu | clang++ または g++ | `apt install clang` または `apt install g++` |
+| Windows | MSVC | Visual Studio 2022 以降（C++ コンポーネントを含めてインストール） |
+
+## Hello World サーバー
+
+次のコードを `server.cpp` として保存しましょう。
+
+```cpp
+#include "httplib.h"
+
+int main() {
+    httplib::Server svr;
+
+    svr.Get("/", [](const httplib::Request&, httplib::Response& res) {
+        res.set_content("Hello, World!", "text/plain");
+    });
+
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+たった数行で、HTTPリクエストに応答するサーバーが書けます。
+
+## コンパイルと実行
+
+このチュートリアルのサンプルコードは、コードを簡潔に書けるC++17で書いています。cpp-httplib自体はC++11でもコンパイルできます。
+
+```sh
+# macOS
+clang++ -std=c++17 -o server server.cpp
+
+# Linux
+# `-pthread`: cpp-httplibは内部でスレッドを使用
+clang++ -std=c++17 -pthread -o server server.cpp
+
+# Windows (Developer Command Prompt)
+# `/EHsc`: C++例外処理を有効化
+cl /EHsc /std:c++17 server.cpp
+```
+
+コンパイルできたら実行します。
+
+```sh
+# macOS / Linux
+./server
+
+# Windows
+server.exe
+```
+
+ブラウザで `http://localhost:8080` を開いてください。"Hello, World!" と表示されれば成功です。
+
+`curl` でも確認できます。
+
+```sh
+curl http://localhost:8080/
+# Hello, World!
+```
+
+サーバーを停止するには、ターミナルで `Ctrl+C` を押します。
+
+## 次のステップ
+
+サーバーの基本がわかりましたね。次は、クライアント側を見てみましょう。cpp-httplibはHTTPクライアント機能も備えています。
+
+**次:** [Basic Client](../02-basic-client)

docs-src/pages/ja/tour/02-basic-client.md

@@ -0,0 +1,266 @@
+---
+title: "Basic Client"
+order: 2
+---
+
+cpp-httplibはサーバーだけでなく、HTTPクライアント機能も備えています。`httplib::Client` を使って、GETやPOSTリクエストを送ってみましょう。
+
+## テスト用サーバーの準備
+
+クライアントの動作を確認するために、リクエストを受け付けるサーバーを用意します。次のコードを保存し、前章と同じ手順でコンパイル・実行してください。サーバーの詳しい解説は次章で行います。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.Get("/hi", [](const auto &, auto &res) {
+        res.set_content("Hello!", "text/plain");
+    });
+
+    svr.Get("/search", [](const auto &req, auto &res) {
+        auto q = req.get_param_value("q");
+        res.set_content("Query: " + q, "text/plain");
+    });
+
+    svr.Post("/post", [](const auto &req, auto &res) {
+        res.set_content(req.body, "text/plain");
+    });
+
+    svr.Post("/submit", [](const auto &req, auto &res) {
+        std::string result;
+        for (auto &[key, val] : req.params) {
+            result += key + " = " + val + "\n";
+        }
+        res.set_content(result, "text/plain");
+    });
+
+    svr.Post("/upload", [](const auto &req, auto &res) {
+        auto f = req.form.get_file("file");
+        auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+        res.set_content(content, "text/plain");
+    });
+
+    svr.Get("/users/:id", [](const auto &req, auto &res) {
+        auto id = req.path_params.at("id");
+        res.set_content("User ID: " + id, "text/plain");
+    });
+
+    svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+        auto id = req.matches[1];
+        res.set_content("File ID: " + std::string(id), "text/plain");
+    });
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+## GETリクエスト
+
+サーバーが起動したら、別のターミナルを開いて試してみましょう。まず、最もシンプルなGETリクエストです。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://localhost:8080");
+
+    auto res = cli.Get("/hi");
+    if (res) {
+        std::cout << res->status << std::endl;  // 200
+        std::cout << res->body << std::endl;    // Hello!
+    }
+}
+```
+
+`httplib::Client` のコンストラクターにサーバーのアドレスを渡し、`Get()` でリクエストを送ります。戻り値の `res` からステータスコードやボディを取得できます。
+
+対応する `curl` コマンドはこうなります。
+
+```sh
+curl http://localhost:8080/hi
+# Hello!
+```
+
+## レスポンスの確認
+
+レスポンスには、ステータスコードとボディ以外にもヘッダー情報が含まれています。
+
+```cpp
+auto res = cli.Get("/hi");
+if (res) {
+    // ステータスコード
+    std::cout << res->status << std::endl;  // 200
+
+    // ボディ
+    std::cout << res->body << std::endl;  // Hello!
+
+    // ヘッダー
+    std::cout << res->get_header_value("Content-Type") << std::endl;  // text/plain
+}
+```
+
+`res->body` は `std::string` なので、JSON レスポンスをパースしたい場合は [nlohmann/json](https://github.com/nlohmann/json) などの JSON ライブラリにそのまま渡せます。
+
+## クエリパラメーター
+
+GETリクエストにクエリパラメーターを付けるには、URLに直接書くか、`httplib::Params` を使います。
+
+```cpp
+auto res = cli.Get("/search", httplib::Params{{"q", "cpp-httplib"}});
+if (res) {
+    std::cout << res->body << std::endl;  // Query: cpp-httplib
+}
+```
+
+`httplib::Params` を使うと、特殊文字のURLエンコードを自動で行ってくれます。
+
+```sh
+curl "http://localhost:8080/search?q=cpp-httplib"
+# Query: cpp-httplib
+```
+
+## パスパラメーター
+
+URLのパスに値を直接埋め込む場合も、クライアント側は特別なAPIは不要です。パスをそのまま `Get()` に渡すだけです。
+
+```cpp
+auto res = cli.Get("/users/42");
+if (res) {
+    std::cout << res->body << std::endl;  // User ID: 42
+}
+```
+
+```sh
+curl http://localhost:8080/users/42
+# User ID: 42
+```
+
+テスト用サーバーには、正規表現でIDを数字のみに絞った `/files/(\d+)` もあります。
+
+```cpp
+auto res = cli.Get("/files/42");
+if (res) {
+    std::cout << res->body << std::endl;  // File ID: 42
+}
+```
+
+```sh
+curl http://localhost:8080/files/42
+# File ID: 42
+```
+
+`/files/abc` のように数字以外を渡すと404が返ります。仕組みは次章で解説します。
+
+## リクエストヘッダー
+
+カスタムHTTPヘッダーを付けるには、`httplib::Headers` を渡します。`Get()` や `Post()` のどちらでも使えます。
+
+```cpp
+auto res = cli.Get("/hi", httplib::Headers{
+    {"Authorization", "Bearer my-token"}
+});
+```
+
+```sh
+curl -H "Authorization: Bearer my-token" http://localhost:8080/hi
+```
+
+## POSTリクエスト
+
+テキストデータをPOSTしてみましょう。`Post()` の第2引数にボディ、第3引数にContent-Typeを指定します。
+
+```cpp
+auto res = cli.Post("/post", "Hello, Server!", "text/plain");
+if (res) {
+    std::cout << res->status << std::endl;  // 200
+    std::cout << res->body << std::endl;    // Hello, Server!
+}
+```
+
+テスト用サーバーの `/post` はボディをそのまま返すので、送った文字列がそのまま返ってきます。
+
+```sh
+curl -X POST -H "Content-Type: text/plain" -d "Hello, Server!" http://localhost:8080/post
+# Hello, Server!
+```
+
+## フォームデータの送信
+
+HTMLフォームのように、キーと値のペアを送ることもできます。`httplib::Params` を使います。
+
+```cpp
+auto res = cli.Post("/submit", httplib::Params{
+    {"name", "Alice"},
+    {"age", "30"}
+});
+if (res) {
+    std::cout << res->body << std::endl;
+    // age = 30
+    // name = Alice
+}
+```
+
+これは `application/x-www-form-urlencoded` 形式で送信されます。
+
+```sh
+curl -X POST -d "name=Alice&age=30" http://localhost:8080/submit
+```
+
+## ファイルのPOST
+
+ファイルをアップロードするには、`httplib::UploadFormDataItems` を使ってマルチパートフォームデータとして送信します。
+
+```cpp
+auto res = cli.Post("/upload", httplib::UploadFormDataItems{
+    {"file", "Hello, File!", "hello.txt", "text/plain"}
+});
+if (res) {
+    std::cout << res->body << std::endl;  // hello.txt (12 bytes)
+}
+```
+
+`UploadFormDataItems` の各要素は `{name, content, filename, content_type}` の4つのフィールドで構成されます。
+
+```sh
+curl -F "file=Hello, File!;filename=hello.txt;type=text/plain" http://localhost:8080/upload
+```
+
+## エラーハンドリング
+
+ネットワーク通信では、サーバーに接続できない場合があります。`res` が有効かどうかを必ず確認しましょう。
+
+```cpp
+httplib::Client cli("http://localhost:9999");  // 存在しないポート
+auto res = cli.Get("/hi");
+
+if (!res) {
+    // 接続エラー
+    std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    // Error: Connection
+    return 1;
+}
+
+// ここに到達すればレスポンスを受信できている
+if (res->status != 200) {
+    std::cout << "HTTP Error: " << res->status << std::endl;
+    return 1;
+}
+
+std::cout << res->body << std::endl;
+```
+
+エラーには2つのレベルがあります。
+
+- **接続エラー**: サーバーに到達できなかった場合。`res` が偽になり、`res.error()` でエラーの種類を取得できます
+- **HTTPエラー**: サーバーからエラーステータス（404、500など）が返ってきた場合。`res` は真ですが、`res->status` を確認する必要があります
+
+## 次のステップ
+
+クライアントからリクエストを送る方法がわかりました。次は、サーバー側をもっと詳しく見てみましょう。ルーティングやパスパラメータなど、サーバーの機能を掘り下げます。
+
+**次:** [Basic Server](../03-basic-server)

docs-src/pages/ja/tour/03-basic-server.md

@@ -0,0 +1,280 @@
+---
+title: "Basic Server"
+order: 3
+---
+
+前章ではクライアントからリクエストを送りました。そのとき、テスト用サーバーを用意しましたね。この章では、あのサーバーの仕組みをひとつずつ紐解いていきます。
+
+## サーバーの起動
+
+ルーティングを登録したら、最後に `svr.listen()` を呼んでサーバーを起動します。
+
+```cpp
+svr.listen("0.0.0.0", 8080);
+```
+
+第1引数はホスト、第2引数はポート番号です。`"0.0.0.0"` を指定すると、すべてのネットワークインターフェースでリクエストを受け付けます。自分のマシンからのアクセスだけに限定したいときは `"127.0.0.1"` を使います。
+
+`listen()` はブロッキング呼び出しです。サーバーが停止するまで、この行から先には進みません。ターミナルで `Ctrl+C` を押すか、別スレッドから `svr.stop()` を呼ぶまでサーバーは動き続けます。
+
+## ルーティング
+
+サーバーの核になるのは「ルーティング」です。どのURLに、どのHTTPメソッドでアクセスされたら、何をするか。それを登録する仕組みです。
+
+```cpp
+httplib::Server svr;
+
+svr.Get("/hi", [](const httplib::Request &req, httplib::Response &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+`svr.Get()` は、GETリクエストに対するハンドラーを登録します。第1引数がパス、第2引数がハンドラー関数です。`/hi` にGETリクエストが来たら、このラムダが呼ばれます。
+
+HTTPメソッドごとにメソッドが用意されています。
+
+```cpp
+svr.Get("/path",    handler);  // GET
+svr.Post("/path",   handler);  // POST
+svr.Put("/path",    handler);  // PUT
+svr.Delete("/path", handler);  // DELETE
+```
+
+ハンドラーのシグネチャは `(const httplib::Request &req, httplib::Response &res)` です。`auto` を使って短く書くこともできます。
+
+```cpp
+svr.Get("/hi", [](const auto &req, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+パスが一致したときだけハンドラーが呼ばれます。登録されていないパスにアクセスすると、自動的に404が返ります。
+
+## リクエストオブジェクト
+
+ハンドラーの第1引数 `req` から、クライアントが送ってきた情報を読み取れます。
+
+### ボディ
+
+`req.body` でリクエストボディを取得できます。型は `std::string` です。
+
+```cpp
+svr.Post("/post", [](const auto &req, auto &res) {
+    // クライアントが送ったボディをそのまま返す
+    res.set_content(req.body, "text/plain");
+});
+```
+
+### ヘッダー
+
+`req.get_header_value()` でリクエストヘッダーの値を取得できます。
+
+```cpp
+svr.Get("/check", [](const auto &req, auto &res) {
+    auto auth = req.get_header_value("Authorization");
+    res.set_content("Auth: " + auth, "text/plain");
+});
+```
+
+### クエリパラメーターとフォームデータ
+
+`req.get_param_value()` でパラメーターを取得できます。GETのクエリパラメーターと、POSTのフォームデータの両方に使えます。
+
+```cpp
+svr.Get("/search", [](const auto &req, auto &res) {
+    auto q = req.get_param_value("q");
+    res.set_content("Query: " + q, "text/plain");
+});
+```
+
+`/search?q=cpp-httplib` にアクセスすると、`q` の値は `"cpp-httplib"` になります。
+
+すべてのパラメーターをループで処理したいときは、`req.params` を使います。
+
+```cpp
+svr.Post("/submit", [](const auto &req, auto &res) {
+    std::string result;
+    for (auto &[key, val] : req.params) {
+        result += key + " = " + val + "\n";
+    }
+    res.set_content(result, "text/plain");
+});
+```
+
+### ファイルアップロード
+
+マルチパートフォームでアップロードされたファイルは、`req.form.get_file()` で取得します。
+
+```cpp
+svr.Post("/upload", [](const auto &req, auto &res) {
+    auto f = req.form.get_file("file");
+    auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+    res.set_content(content, "text/plain");
+});
+```
+
+`f.filename` でファイル名、`f.content` でファイルの中身にアクセスできます。
+
+## パスパラメーター
+
+URLの一部を変数として受け取りたいことがあります。たとえば `/users/42` の `42` を取得したい場合です。`:param` 記法を使うと、URLの一部をキャプチャできます。
+
+```cpp
+svr.Get("/users/:id", [](const auto &req, auto &res) {
+    auto id = req.path_params.at("id");
+    res.set_content("User ID: " + id, "text/plain");
+});
+```
+
+`/users/42` にアクセスすると、`req.path_params.at("id")` は `"42"` を返します。`/users/100` なら `"100"` です。
+
+複数のパスパラメーターも使えます。
+
+```cpp
+svr.Get("/users/:user_id/posts/:post_id", [](const auto &req, auto &res) {
+    auto user_id = req.path_params.at("user_id");
+    auto post_id = req.path_params.at("post_id");
+    res.set_content("User: " + user_id + ", Post: " + post_id, "text/plain");
+});
+```
+
+### 正規表現パターン
+
+`:param` の代わりに正規表現をパスに書くこともできます。キャプチャグループの値は `req.matches` で取得します。型は `std::smatch` です。
+
+```cpp
+// 数字のみのIDを受け付ける
+svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+    auto id = req.matches[1];  // 最初のキャプチャグループ
+    res.set_content("File ID: " + std::string(id), "text/plain");
+});
+```
+
+`/files/42` にはマッチしますが、`/files/abc` にはマッチしません。入力値を絞り込みたいときに便利です。
+
+## レスポンスの組み立て
+
+ハンドラーの第2引数 `res` を使って、クライアントに返すレスポンスを組み立てます。
+
+### ボディとContent-Type
+
+`res.set_content()` でボディとContent-Typeを設定します。これだけでステータスコード200のレスポンスが返ります。
+
+```cpp
+svr.Get("/hi", [](const auto &req, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+### ステータスコード
+
+ステータスコードを変えたいときは、`res.status` に代入します。
+
+```cpp
+svr.Get("/not-found", [](const auto &req, auto &res) {
+    res.status = 404;
+    res.set_content("Not found", "text/plain");
+});
+```
+
+### レスポンスヘッダー
+
+`res.set_header()` でレスポンスヘッダーを追加できます。
+
+```cpp
+svr.Get("/with-header", [](const auto &req, auto &res) {
+    res.set_header("X-Custom", "my-value");
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+## 前章のサーバーを読み解く
+
+ここまでの知識を使って、前章で用意したテスト用サーバーを改めて見てみましょう。
+
+### GET /hi
+
+```cpp
+svr.Get("/hi", [](const auto &, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+最もシンプルなハンドラーです。リクエストの情報は使わないので、`req` の変数名を省略しています。`"Hello!"` というテキストをそのまま返します。
+
+### GET /search
+
+```cpp
+svr.Get("/search", [](const auto &req, auto &res) {
+    auto q = req.get_param_value("q");
+    res.set_content("Query: " + q, "text/plain");
+});
+```
+
+`req.get_param_value("q")` でクエリパラメーター `q` の値を取り出します。`/search?q=cpp-httplib` なら、レスポンスは `"Query: cpp-httplib"` になります。
+
+### POST /post
+
+```cpp
+svr.Post("/post", [](const auto &req, auto &res) {
+    res.set_content(req.body, "text/plain");
+});
+```
+
+クライアントが送ったリクエストボディを、そのままレスポンスとして返すエコーサーバーです。`req.body` にボディが丸ごと入っています。
+
+### POST /submit
+
+```cpp
+svr.Post("/submit", [](const auto &req, auto &res) {
+    std::string result;
+    for (auto &[key, val] : req.params) {
+        result += key + " = " + val + "\n";
+    }
+    res.set_content(result, "text/plain");
+});
+```
+
+フォームデータとして送られたキーと値のペアを、`req.params` でループ処理しています。構造化束縛 `auto &[key, val]` を使って、各ペアを取り出しています。
+
+### POST /upload
+
+```cpp
+svr.Post("/upload", [](const auto &req, auto &res) {
+    auto f = req.form.get_file("file");
+    auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+    res.set_content(content, "text/plain");
+});
+```
+
+マルチパートフォームで送られたファイルを受け取ります。`req.form.get_file("file")` で `"file"` という名前のフィールドを取得し、`f.filename` と `f.content.size()` でファイル名とサイズを返しています。
+
+### GET /users/:id
+
+```cpp
+svr.Get("/users/:id", [](const auto &req, auto &res) {
+    auto id = req.path_params.at("id");
+    res.set_content("User ID: " + id, "text/plain");
+});
+```
+
+`:id` の部分がパスパラメーターです。`req.path_params.at("id")` で値を取り出しています。`/users/42` なら `"42"`、`/users/alice` なら `"alice"` が得られます。
+
+### GET /files/(\d+)
+
+```cpp
+svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+    auto id = req.matches[1];
+    res.set_content("File ID: " + std::string(id), "text/plain");
+});
+```
+
+正規表現 `(\d+)` で数字だけのIDにマッチします。`/files/42` にはマッチしますが、`/files/abc` は404になります。`req.matches[1]` で最初のキャプチャグループの値を取得しています。
+
+## 次のステップ
+
+サーバーの基本がわかりましたね。ルーティング、リクエストの読み取り、レスポンスの組み立て。これだけで、十分に実用的なAPIサーバーが作れます。
+
+次は、静的ファイルの配信を見てみましょう。HTMLやCSSを配信するサーバーを作ります。
+
+**次:** [Static File Server](../04-static-file-server)

docs-src/pages/ja/tour/04-static-file-server.md

@@ -0,0 +1,134 @@
+---
+title: "Static File Server"
+order: 4
+---
+
+cpp-httplibは、HTMLやCSS、画像ファイルなどの静的ファイルも配信できます。面倒な設定は要りません。`set_mount_point()` を1行呼ぶだけです。
+
+## set_mount_point の基本
+
+さっそくやってみましょう。`set_mount_point()` は、URLのパスとローカルディレクトリを紐づけます。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.set_mount_point("/", "./html");
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+第1引数がURLのマウントポイント、第2引数がローカルのディレクトリパスです。この例だと、`/` へのリクエストを `./html` ディレクトリから配信します。
+
+試してみましょう。まず `html` ディレクトリを作って、`index.html` を置きます。
+
+```sh
+mkdir html
+```
+
+```html
+<!DOCTYPE html>
+<html>
+<head><title>My Page</title></head>
+<body>
+    <h1>Hello from cpp-httplib!</h1>
+    <p>This is a static file.</p>
+</body>
+</html>
+```
+
+コンパイルして起動します。
+
+```sh
+g++ -std=c++17 -o server server.cpp -pthread
+./server
+```
+
+ブラウザで `http://localhost:8080` を開いてみてください。`html/index.html` の内容が表示されるはずです。`http://localhost:8080/index.html` でも同じページが返ります。
+
+もちろん、前章のクライアントコードや `curl` でもアクセスできますよ。
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+auto res = cli.Get("/");
+if (res) {
+    std::cout << res->body << std::endl;  // HTMLが表示される
+}
+```
+
+```sh
+curl http://localhost:8080
+```
+
+## 複数のマウントポイント
+
+`set_mount_point()` は何回でも呼べます。URLのパスごとに、別々のディレクトリを割り当てられます。
+
+```cpp
+svr.set_mount_point("/", "./public");
+svr.set_mount_point("/assets", "./static/assets");
+svr.set_mount_point("/docs", "./documentation");
+```
+
+`/assets/style.css` なら `./static/assets/style.css` を、`/docs/guide.html` なら `./documentation/guide.html` を配信します。
+
+## ハンドラーとの組み合わせ
+
+静的ファイルの配信と、前章で学んだルーティングハンドラーは共存できます。
+
+```cpp
+httplib::Server svr;
+
+// APIエンドポイント
+svr.Get("/api/hello", [](const auto &, auto &res) {
+    res.set_content(R"({"message":"Hello!"})", "application/json");
+});
+
+// 静的ファイル配信
+svr.set_mount_point("/", "./public");
+
+svr.listen("0.0.0.0", 8080);
+```
+
+ハンドラーが先に評価されます。`/api/hello` にはハンドラーが応答し、それ以外のパスは `./public` ディレクトリからファイルを探します。
+
+## レスポンスヘッダーの追加
+
+`set_mount_point()` の第3引数にヘッダーを渡すと、静的ファイルのレスポンスにカスタムヘッダーを付けられます。キャッシュ制御に便利です。
+
+```cpp
+svr.set_mount_point("/", "./public", {
+    {"Cache-Control", "max-age=3600"}
+});
+```
+
+こうすると、ブラウザは配信されたファイルを1時間キャッシュします。
+
+## 静的ファイルサーバー用のDockerファイル
+
+cpp-httplibのリポジトリには、静的ファイルサーバー用の `Dockerfile` が含まれています。Docker Hubにビルド済みイメージも公開しているので、1コマンドで起動できます。
+
+```sh
+> docker run -p 8080:80 -v ./my-site:/html yhirose4dockerhub/cpp-httplib-server
+Serving HTTP on 0.0.0.0:80
+Mount point: / -> ./html
+Press Ctrl+C to shutdown gracefully...
+192.168.65.1 - - [22/Feb/2026:12:00:00 +0000] "GET / HTTP/1.1" 200 256 "-" "Mozilla/5.0 ..."
+192.168.65.1 - - [22/Feb/2026:12:00:00 +0000] "GET /style.css HTTP/1.1" 200 1024 "-" "Mozilla/5.0 ..."
+192.168.65.1 - - [22/Feb/2026:12:00:01 +0000] "GET /favicon.ico HTTP/1.1" 404 152 "-" "Mozilla/5.0 ..."
+```
+
+`./my-site` ディレクトリの中身が、そのままポート8080で配信されます。NGINXと同じログ形式で、アクセスの様子を確認できますよ。
+
+## 次のステップ
+
+静的ファイルの配信ができるようになりましたね。HTMLやCSS、JavaScriptを配信するWebサーバーが、これだけのコードで作れます。
+
+次は、HTTPSで暗号化通信をしてみましょう。まずはTLSライブラリのセットアップからです。
+
+**次:** [TLS Setup](../05-tls-setup)

docs-src/pages/ja/tour/05-tls-setup.md

@@ -0,0 +1,88 @@
+---
+title: "TLS Setup"
+order: 5
+---
+
+ここまではHTTP（平文）でやってきましたが、実際のWebではHTTPS（暗号化通信）が当たり前ですよね。cpp-httplibでHTTPSを使うには、TLSライブラリが必要です。
+
+このTourではOpenSSLを使います。最も広く使われていて、情報も豊富です。
+
+## OpenSSLのインストール
+
+お使いのOSに合わせてインストールしましょう。
+
+| OS | インストール方法 |
+| -- | ---------------- |
+| macOS | [Homebrew](https://brew.sh/) (`brew install openssl`) |
+| Ubuntu / Debian | `sudo apt install libssl-dev` |
+| Windows | [vcpkg](https://vcpkg.io/) (`vcpkg install openssl`) |
+
+## コンパイルオプション
+
+TLS機能を有効にするには、`CPPHTTPLIB_OPENSSL_SUPPORT` マクロを定義してコンパイルします。前章までのコンパイルコマンドに、いくつかオプションが増えます。
+
+```sh
+# macOS (Homebrew)
+clang++ -std=c++17 -DCPPHTTPLIB_OPENSSL_SUPPORT \
+    -I$(brew --prefix openssl)/include \
+    -L$(brew --prefix openssl)/lib \
+    -lssl -lcrypto \
+    -framework CoreFoundation -framework Security \
+    -o server server.cpp
+
+# Linux
+clang++ -std=c++17 -pthread -DCPPHTTPLIB_OPENSSL_SUPPORT \
+    -lssl -lcrypto \
+    -o server server.cpp
+
+# Windows (Developer Command Prompt)
+cl /EHsc /std:c++17 /DCPPHTTPLIB_OPENSSL_SUPPORT server.cpp libssl.lib libcrypto.lib
+```
+
+それぞれのオプションの役割を見てみましょう。
+
+- **`-DCPPHTTPLIB_OPENSSL_SUPPORT`** — TLS機能を有効にするマクロ定義
+- **`-lssl -lcrypto`** — OpenSSLのライブラリをリンク
+- **`-I` / `-L`**（macOSのみ）— Homebrew版OpenSSLのパスを指定
+- **`-framework CoreFoundation -framework Security`**（macOSのみ）— Keychainからシステム証明書を自動で読み込むために必要です
+
+## 動作確認
+
+ちゃんと動くか確認してみましょう。`httplib::Client` にHTTPSのURLを渡してアクセスするだけのプログラムです。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://www.google.com");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << "Status: " << res->status << std::endl;
+    } else {
+        std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    }
+}
+```
+
+コンパイルして実行してみてください。`Status: 200` と表示されれば、セットアップ完了です。
+
+## 他のTLSバックエンド
+
+cpp-httplibはOpenSSL以外にも、Mbed TLSとwolfSSLに対応しています。マクロ定義とリンクするライブラリを変えるだけで切り替えられます。
+
+| バックエンド | マクロ定義 | リンクするライブラリ |
+| :--- | :--- | :--- |
+| OpenSSL | `CPPHTTPLIB_OPENSSL_SUPPORT` | `libssl`, `libcrypto` |
+| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` |
+| wolfSSL | `CPPHTTPLIB_WOLFSSL_SUPPORT` | `libwolfssl` |
+
+このTourではOpenSSLを前提に進めますが、APIはどのバックエンドでも共通です。
+
+## 次のステップ
+
+TLSの準備ができましたね。次は、HTTPSサイトにリクエストを送ってみましょう。
+
+**次:** [HTTPS Client](../06-https-client)

docs-src/pages/ja/tour/06-https-client.md

@@ -0,0 +1,122 @@
+---
+title: "HTTPS Client"
+order: 6
+---
+
+前章でOpenSSLのセットアップが済んだので、さっそくHTTPSクライアントを使ってみましょう。2章で使った `httplib::Client` がそのまま使えます。コンストラクタに `https://` 付きのURLを渡すだけです。
+
+## GETリクエスト
+
+実在するHTTPSサイトにアクセスしてみましょう。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://nghttp2.org");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->status << std::endl;           // 200
+        std::cout << res->body.substr(0, 100) << std::endl;  // HTMLの先頭部分
+    } else {
+        std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    }
+}
+```
+
+2章では `httplib::Client cli("http://localhost:8080")` と書きましたよね。スキームを `https://` に変えるだけです。`Get()` や `Post()` など、2章で学んだAPIはすべてそのまま使えます。
+
+```sh
+curl https://nghttp2.org/
+```
+
+## ポートの指定
+
+HTTPSのデフォルトポートは443です。別のポートを使いたい場合は、URLにポートを含めます。
+
+```cpp
+httplib::Client cli("https://localhost:8443");
+```
+
+## CA証明書の検証
+
+`httplib::Client` はHTTPS接続時、デフォルトでサーバー証明書を検証します。信頼できるCA（認証局）が発行した証明書を持つサーバーにしか接続しません。
+
+CA証明書は、macOSならKeychain、LinuxならシステムのCA証明書ストア、WindowsならWindowsの証明書ストアから自動で読み込みます。ほとんどの場合、追加の設定は要りません。
+
+### CA証明書ファイルの指定
+
+環境によってはシステムのCA証明書が見つからないこともあります。そのときは `set_ca_cert_path()` でパスを直接指定してください。
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+cli.set_ca_cert_path("/etc/ssl/certs/ca-certificates.crt");
+
+auto res = cli.Get("/");
+```
+
+```sh
+curl --cacert /etc/ssl/certs/ca-certificates.crt https://nghttp2.org/
+```
+
+### 証明書検証の無効化
+
+開発中、自己署名証明書のサーバーに接続したいときは、検証を無効にできます。
+
+```cpp
+httplib::Client cli("https://localhost:8443");
+cli.enable_server_certificate_verification(false);
+
+auto res = cli.Get("/");
+```
+
+```sh
+curl -k https://localhost:8443/
+```
+
+本番では絶対に無効にしないでください。中間者攻撃のリスクがあります。
+
+## リダイレクトの追跡
+
+HTTPSサイトへのアクセスでは、リダイレクトに遭遇することがよくあります。たとえば `http://` から `https://` へ、あるいは `www` なしから `www` ありへ転送されるケースです。
+
+デフォルトではリダイレクトを追跡しません。リダイレクト先は `Location` ヘッダーで確認できます。
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+
+auto res = cli.Get("/httpbin/redirect/3");
+if (res) {
+    std::cout << res->status << std::endl;  // 302
+    std::cout << res->get_header_value("Location") << std::endl;
+}
+```
+
+```sh
+curl https://nghttp2.org/httpbin/redirect/3
+```
+
+`set_follow_location(true)` を設定すると、リダイレクトを自動で追跡して、最終的なレスポンスを返してくれます。
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+cli.set_follow_location(true);
+
+auto res = cli.Get("/httpbin/redirect/3");
+if (res) {
+    std::cout << res->status << std::endl;  // 200（最終的なレスポンス）
+}
+```
+
+```sh
+curl -L https://nghttp2.org/httpbin/redirect/3
+```
+
+## 次のステップ
+
+HTTPSクライアントの使い方がわかりましたね。次は自分でHTTPSサーバーを立ててみましょう。自己署名証明書の作り方から始めます。
+
+**次:** [HTTPS Server](../07-https-server)

docs-src/pages/ja/tour/07-https-server.md

@@ -0,0 +1,124 @@
+---
+title: "HTTPS Server"
+order: 7
+---
+
+前章ではHTTPSクライアントを使いました。今度は自分でHTTPSサーバーを立ててみましょう。3章の `httplib::Server` を `httplib::SSLServer` に置き換えるだけです。
+
+ただし、TLSサーバーにはサーバー証明書と秘密鍵が必要です。まずはそこから準備しましょう。
+
+## 自己署名証明書の作成
+
+開発やテスト用なら、自己署名証明書（いわゆるオレオレ証明書）で十分です。OpenSSLのコマンドでサクッと作れます。
+
+```sh
+openssl req -x509 -noenc -keyout key.pem -out cert.pem -subj /CN=localhost
+```
+
+これで2つのファイルができます。
+
+- **`cert.pem`** — サーバー証明書
+- **`key.pem`** — 秘密鍵
+
+## 最小のHTTPSサーバー
+
+証明書ができたら、さっそくサーバーを書いてみましょう。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::SSLServer svr("cert.pem", "key.pem");
+
+    svr.Get("/", [](const auto &, auto &res) {
+        res.set_content("Hello, HTTPS!", "text/plain");
+    });
+
+    std::cout << "Listening on https://localhost:8443" << std::endl;
+    svr.listen("0.0.0.0", 8443);
+}
+```
+
+`httplib::SSLServer` のコンストラクタに証明書と秘密鍵のパスを渡すだけです。ルーティングの書き方は3章の `httplib::Server` とまったく同じですよ。
+
+コンパイルして起動しましょう。
+
+## 動作確認
+
+サーバーが起動したら、`curl` でアクセスしてみましょう。自己署名証明書なので、`-k` オプションで証明書検証をスキップします。
+
+```sh
+curl -k https://localhost:8443/
+# Hello, HTTPS!
+```
+
+ブラウザで `https://localhost:8443` を開くと、「この接続は安全ではありません」と警告が出ます。自己署名証明書なので正常です。気にせず進めてください。
+
+## クライアントからの接続
+
+前章の `httplib::Client` で接続してみましょう。自己署名証明書のサーバーに接続するには、2つの方法があります。
+
+### 方法1: 証明書検証を無効にする
+
+開発時の手軽な方法です。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://localhost:8443");
+    cli.enable_server_certificate_verification(false);
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->body << std::endl;  // Hello, HTTPS!
+    }
+}
+```
+
+### 方法2: 自己署名証明書をCA証明書として指定する
+
+こちらのほうが安全です。`cert.pem` をCA証明書として信頼するよう指定します。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://localhost:8443");
+    cli.set_ca_cert_path("cert.pem");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->body << std::endl;  // Hello, HTTPS!
+    }
+}
+```
+
+この方法なら、指定した証明書のサーバーにだけ接続を許可して、なりすましを防げます。テスト環境でもなるべくこちらを使いましょう。
+
+## Server と SSLServer の比較
+
+3章で学んだ `httplib::Server` のAPIは、`httplib::SSLServer` でもそのまま使えます。違いはコンストラクタだけです。
+
+| | `httplib::Server` | `httplib::SSLServer` |
+| -- | ------------------ | -------------------- |
+| コンストラクタ | 引数なし | 証明書と秘密鍵のパス |
+| プロトコル | HTTP | HTTPS |
+| ポート（慣例） | 8080 | 8443 |
+| ルーティング | 共通 | 共通 |
+
+HTTPサーバーをHTTPSに切り替えるには、コンストラクタを変えるだけです。
+
+## 次のステップ
+
+HTTPSサーバーが動きましたね。これでHTTP/HTTPSのクライアントとサーバー、両方の基本がそろいました。
+
+次は、cpp-httplibに新しく加わったWebSocket機能を見てみましょう。
+
+**次:** [WebSocket](../08-websocket)

docs-src/pages/ja/tour/08-websocket.md

@@ -0,0 +1,139 @@
+---
+title: "WebSocket"
+order: 8
+---
+
+cpp-httplibはWebSocketにも対応しています。HTTPのリクエスト/レスポンスと違い、WebSocketはサーバーとクライアントが双方向にメッセージをやり取りできます。チャットやリアルタイム通知に便利です。
+
+さっそく、エコーサーバーとクライアントを作ってみましょう。
+
+## エコーサーバー
+
+受け取ったメッセージをそのまま返すエコーサーバーです。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+        std::string msg;
+        while (ws.read(msg)) {
+            ws.send(msg);  // 受け取ったメッセージをそのまま返す
+        }
+    });
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+`svr.WebSocket()` でWebSocketハンドラーを登録します。3章の `svr.Get()` や `svr.Post()` と同じ感覚ですね。
+
+ハンドラーの中では、`ws.read(msg)` でメッセージを待ちます。接続が閉じられると `read()` が `false` を返すので、ループを抜けます。`ws.send(msg)` でメッセージを送り返します。
+
+## クライアントからの接続
+
+`httplib::ws::WebSocketClient` を使ってサーバーに接続してみましょう。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::ws::WebSocketClient client("ws://localhost:8080/ws");
+
+    if (!client.connect()) {
+        std::cout << "Connection failed" << std::endl;
+        return 1;
+    }
+
+    // メッセージを送信
+    client.send("Hello, WebSocket!");
+
+    // サーバーからの応答を受信
+    std::string msg;
+    if (client.read(msg)) {
+        std::cout << msg << std::endl;  // Hello, WebSocket!
+    }
+
+    client.close();
+}
+```
+
+コンストラクタには `ws://host:port/path` 形式のURLを渡します。`connect()` で接続を開始し、`send()` と `read()` でメッセージをやり取りします。
+
+## テキストとバイナリ
+
+WebSocketにはテキストとバイナリの2種類のメッセージがあります。`read()` の戻り値で区別できます。
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    httplib::ws::ReadResult ret;
+    while ((ret = ws.read(msg))) {
+        if (ret == httplib::ws::Binary) {
+            ws.send(msg.data(), msg.size());  // バイナリとして送信
+        } else {
+            ws.send(msg);  // テキストとして送信
+        }
+    }
+});
+```
+
+- `ws.send(const std::string &)` — テキストメッセージとして送信
+- `ws.send(const char *, size_t)` — バイナリメッセージとして送信
+
+クライアント側も同じAPIです。
+
+## リクエスト情報へのアクセス
+
+ハンドラーの第1引数 `req` から、ハンドシェイク時のHTTPリクエスト情報を読み取れます。認証トークンの確認などに便利です。
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    auto token = req.get_header_value("Authorization");
+    if (token.empty()) {
+        ws.close(httplib::ws::CloseStatus::PolicyViolation, "unauthorized");
+        return;
+    }
+
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send(msg);
+    }
+});
+```
+
+## WSSで使う
+
+HTTPS上のWebSocket（WSS）にも対応しています。サーバー側は `httplib::SSLServer` にWebSocketハンドラーを登録するだけです。
+
+```cpp
+httplib::SSLServer svr("cert.pem", "key.pem");
+
+svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send(msg);
+    }
+});
+
+svr.listen("0.0.0.0", 8443);
+```
+
+クライアント側は `wss://` スキームを使います。
+
+```cpp
+httplib::ws::WebSocketClient client("wss://localhost:8443/ws");
+```
+
+## 次のステップ
+
+WebSocketの基本がわかりましたね。ここまでで Tourは終わりです。
+
+次のページでは、Tourで取り上げなかった機能をまとめて紹介します。
+
+**次:** [What's Next](../09-whats-next)

docs-src/pages/ja/tour/09-whats-next.md

@@ -0,0 +1,228 @@
+---
+title: "What's Next"
+order: 9
+---
+
+Tourお疲れさまでした！ cpp-httplibの基本はひと通り押さえましたね。でも、まだまだ便利な機能があります。Tourで取り上げなかった機能をカテゴリー別に紹介します。
+
+## Streaming API
+
+LLMのストリーミング応答や大きなファイルのダウンロードでは、レスポンス全体をメモリに載せたくないですよね。`stream::Get()` を使えば、データをチャンクごとに処理できます。
+
+```cpp
+httplib::Client cli("http://localhost:11434");
+
+auto result = httplib::stream::Get(cli, "/api/generate");
+
+if (result) {
+    while (result.next()) {
+        std::cout.write(result.data(), result.size());
+    }
+}
+```
+
+`Get()` に `content_receiver` コールバックを渡す方法もあります。こちらはKeep-Aliveと併用できます。
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+
+cli.Get("/stream", [](const char *data, size_t len) {
+    std::cout.write(data, len);
+    return true;
+});
+```
+
+サーバー側には `set_content_provider()` と `set_chunked_content_provider()` があります。サイズがわかっているなら前者、不明なら後者を使ってください。
+
+```cpp
+// サイズ指定あり（Content-Length が設定される）
+svr.Get("/file", [](const auto &, auto &res) {
+    auto size = get_file_size("large.bin");
+    res.set_content_provider(size, "application/octet-stream",
+        [](size_t offset, size_t length, httplib::DataSink &sink) {
+            // offset から length バイト分を送る
+            return true;
+        });
+});
+
+// サイズ不明（Chunked Transfer Encoding）
+svr.Get("/stream", [](const auto &, auto &res) {
+    res.set_chunked_content_provider("text/plain",
+        [](size_t offset, httplib::DataSink &sink) {
+            sink.write("chunk\n", 6);
+            return true;  // falseを返すと終了
+        });
+});
+```
+
+大きなファイルのアップロードには `make_file_provider()` が便利です。ファイルを全部メモリに読み込まず、ストリーミングで送れます。
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+
+auto res = cli.Post("/upload", {}, {}, {
+    httplib::make_file_provider("file", "/path/to/large-file.zip")
+});
+```
+
+## Server-Sent Events (SSE)
+
+SSEクライアントも用意しています。自動再接続や `Last-Event-ID` による再開にも対応しています。
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << msg.event << ": " << msg.data << std::endl;
+});
+
+sse.start();  // ブロッキング、自動再接続あり
+```
+
+イベントタイプごとにハンドラーを分けることもできますよ。
+
+```cpp
+sse.on_event("update", [](const httplib::sse::SSEMessage &msg) {
+    // "update" イベントだけ処理
+});
+```
+
+## 認証
+
+クライアントにはBasic認証、Bearer Token認証、Digest認証のヘルパーを用意しています。
+
+```cpp
+httplib::Client cli("https://api.example.com");
+cli.set_basic_auth("user", "password");
+cli.set_bearer_token_auth("my-token");
+```
+
+## 圧縮
+
+gzip、Brotli、Zstandardによる圧縮・展開に対応しています。使いたい方式のマクロを定義してコンパイルしましょう。
+
+| 圧縮方式 | マクロ定義 |
+| -- | -- |
+| gzip | `CPPHTTPLIB_ZLIB_SUPPORT` |
+| Brotli | `CPPHTTPLIB_BROTLI_SUPPORT` |
+| Zstandard | `CPPHTTPLIB_ZSTD_SUPPORT` |
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_compress(true);    // リクエストボディを圧縮
+cli.set_decompress(true);  // レスポンスボディを展開
+```
+
+## プロキシ
+
+HTTPプロキシ経由で接続できます。
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_proxy("proxy.example.com", 8080);
+cli.set_proxy_basic_auth("user", "password");
+```
+
+## タイムアウト
+
+接続・読み取り・書き込みのタイムアウトを個別に設定できます。
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_connection_timeout(5, 0);  // 5秒
+cli.set_read_timeout(10, 0);       // 10秒
+cli.set_write_timeout(10, 0);      // 10秒
+```
+
+## Keep-Alive
+
+同じサーバーに何度もリクエストするなら、Keep-Aliveを有効にしましょう。TCP接続を再利用するので効率的です。
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_keep_alive(true);
+```
+
+## サーバーのミドルウェア
+
+リクエスト処理の前後にフックを挟めます。
+
+```cpp
+svr.set_pre_routing_handler([](const auto &req, auto &res) {
+    // すべてのリクエストの前に実行される
+    return httplib::Server::HandlerResponse::Unhandled;  // 通常のルーティングに進む
+});
+
+svr.set_post_routing_handler([](const auto &req, auto &res) {
+    // レスポンスが返された後に実行される
+    res.set_header("X-Server", "cpp-httplib");
+});
+```
+
+`res.user_data` を使うと、ミドルウェアからハンドラーにデータを渡せます。認証トークンのデコード結果を共有するときに便利です。
+
+```cpp
+svr.set_pre_routing_handler([](const auto &req, auto &res) {
+    res.user_data["auth_user"] = std::string("alice");
+    return httplib::Server::HandlerResponse::Unhandled;
+});
+
+svr.Get("/me", [](const auto &req, auto &res) {
+    auto user = std::any_cast<std::string>(res.user_data.at("auth_user"));
+    res.set_content("Hello, " + user, "text/plain");
+});
+```
+
+エラーや例外のハンドラーもカスタマイズできますよ。
+
+```cpp
+svr.set_error_handler([](const auto &req, auto &res) {
+    res.set_content("Custom Error Page", "text/html");
+});
+
+svr.set_exception_handler([](const auto &req, auto &res, std::exception_ptr ep) {
+    res.status = 500;
+    res.set_content("Internal Server Error", "text/plain");
+});
+```
+
+## ロギング
+
+サーバーでもクライアントでもロガーを設定できます。
+
+```cpp
+svr.set_logger([](const auto &req, const auto &res) {
+    std::cout << req.method << " " << req.path << " " << res.status << std::endl;
+});
+```
+
+## Unix Domain Socket
+
+TCP以外に、Unix Domain Socketでの通信にも対応しています。同じマシン上のプロセス間通信に使えます。
+
+```cpp
+// サーバー
+httplib::Server svr;
+svr.set_address_family(AF_UNIX);
+svr.listen("/tmp/httplib.sock", 0);
+```
+
+```cpp
+// クライアント
+httplib::Client cli("http://localhost");
+cli.set_address_family(AF_UNIX);
+cli.set_hostname_addr_map({{"localhost", "/tmp/httplib.sock"}});
+
+auto res = cli.Get("/");
+```
+
+## さらに詳しく
+
+もっと詳しく知りたいときは、以下を参照してください。
+
+- Cookbook — よくあるユースケースのレシピ集
+- [README](https://github.com/yhirose/cpp-httplib/blob/master/README.md) — 全APIのリファレンス
+- [README-sse](https://github.com/yhirose/cpp-httplib/blob/master/README-sse.md) — Server-Sent Eventsの使い方
+- [README-stream](https://github.com/yhirose/cpp-httplib/blob/master/README-stream.md) — Streaming APIの使い方
+- [README-websocket](https://github.com/yhirose/cpp-httplib/blob/master/README-websocket.md) — WebSocketサーバーの使い方

docs-src/pages/ja/tour/index.md

@@ -0,0 +1,16 @@
+---
+title: "A Tour of cpp-httplib"
+order: 0
+---
+
+cpp-httplibの基本を、順番に学んでいくチュートリアルです。各章は前の章の内容を踏まえて進む構成なので、1章から順に読んでください。
+
+1. [Getting Started](01-getting-started) — httplib.h の入手とHello Worldサーバー
+2. [Basic Client](02-basic-client) — GET/POST・パスパラメーターのリクエスト送信
+3. [Basic Server](03-basic-server) — ルーティング、パスパラメーター、レスポンスの組み立て
+4. [Static File Server](04-static-file-server) — 静的ファイルの配信
+5. [TLS Setup](05-tls-setup) — OpenSSL / mbedTLS のセットアップ
+6. [HTTPS Client](06-https-client) — HTTPSサイトへのリクエスト
+7. [HTTPS Server](07-https-server) — HTTPSサーバーの構築
+8. [WebSocket](08-websocket) — WebSocket通信の基本
+9. [What's Next](09-whats-next) — さらなる機能の紹介

example/Makefile

@@ -18,7 +18,7 @@ ZLIB_SUPPORT = -DCPPHTTPLIB_ZLIB_SUPPORT -lz
 BROTLI_DIR = $(PREFIX)/opt/brotli
 BROTLI_SUPPORT = -DCPPHTTPLIB_BROTLI_SUPPORT -I$(BROTLI_DIR)/include -L$(BROTLI_DIR)/lib -lbrotlicommon -lbrotlienc -lbrotlidec
 
-all: server client hello simplecli simplesvr upload redirect ssesvr ssecli benchmark one_time_request server_and_client accept_header
+all: server client hello simplecli simplesvr upload redirect ssesvr ssecli wsecho benchmark one_time_request server_and_client accept_header
 
 server : server.cc ../httplib.h Makefile
 	$(CXX) -o server $(CXXFLAGS) server.cc $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT)
@@ -47,6 +47,9 @@ ssesvr : ssesvr.cc ../httplib.h Makefile
 ssecli : ssecli.cc ../httplib.h Makefile
 	$(CXX) -o ssecli $(CXXFLAGS) ssecli.cc $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT)
 
+wsecho : wsecho.cc ../httplib.h Makefile
+	$(CXX) -o wsecho $(CXXFLAGS) wsecho.cc $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT)
+
 benchmark : benchmark.cc ../httplib.h Makefile
 	$(CXX) -o benchmark $(CXXFLAGS) benchmark.cc $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT)
 
@@ -64,4 +67,4 @@ pem:
 	openssl req -new -key key.pem | openssl x509 -days 3650 -req -signkey key.pem > cert.pem
 
 clean:
-	rm server client hello simplecli simplesvr upload redirect ssesvr ssecli benchmark one_time_request server_and_client accept_header *.pem
+	rm server client hello simplecli simplesvr upload redirect ssesvr ssecli wsecho benchmark one_time_request server_and_client accept_header *.pem

example/benchmark.cc

@@ -21,7 +21,7 @@ struct StopWatch {
 int main(void) {
   string body(1024 * 5, 'a');
 
-  httplib::Client cli("httpbin.org", 80);
+  httplib::Client cli("httpcan.org", 80);
 
   for (int i = 0; i < 3; i++) {
     StopWatch sw(to_string(i).c_str());

example/client.cc

@@ -1,7 +1,7 @@
 //
 //  client.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 
@@ -30,7 +30,7 @@ int main(void) {
   } else {
     cout << "error code: " << res.error() << std::endl;
 #ifdef CPPHTTPLIB_OPENSSL_SUPPORT
-    auto result = cli.get_openssl_verify_result();
+    auto result = cli.get_verify_result();
     if (result) {
       cout << "verify error: " << X509_verify_cert_error_string(result) << endl;
     }

example/hello.cc

@@ -1,7 +1,7 @@
 //
 //  hello.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 

example/redirect.cc

@@ -1,7 +1,7 @@
 //
 //  redirect.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 

example/server.cc

@@ -1,7 +1,7 @@
 //
 //  sample.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 

example/server_and_client.cc

@@ -1,7 +1,7 @@
 //
 //  server_and_client.cc
 //
-//  Copyright (c) 2025 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 

example/simplecli.cc

@@ -1,7 +1,7 @@
 //
 //  simplecli.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 

example/simplesvr.cc

@@ -1,7 +1,7 @@
 //
 //  simplesvr.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 

example/ssecli-stream.cc

@@ -0,0 +1,234 @@
+//
+//  ssecli-stream.cc
+//
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
+//  MIT License
+//
+//  SSE (Server-Sent Events) client example using Streaming API
+//  with automatic reconnection support (similar to JavaScript's EventSource)
+//
+
+#include <httplib.h>
+
+#include <chrono>
+#include <iostream>
+#include <string>
+#include <thread>
+
+//------------------------------------------------------------------------------
+// SSE Event Parser
+//------------------------------------------------------------------------------
+// Parses SSE events from the stream according to the SSE specification.
+// SSE format:
+//   event: <event-type>     (optional, defaults to "message")
+//   data: <payload>         (can have multiple lines)
+//   id: <event-id>          (optional, used for reconnection)
+//   retry: <milliseconds>   (optional, reconnection interval)
+//   <blank line>            (signals end of event)
+//
+struct SSEEvent {
+  std::string event = "message"; // Event type (default: "message")
+  std::string data;              // Event payload
+  std::string id;                // Event ID for Last-Event-ID header
+
+  void clear() {
+    event = "message";
+    data.clear();
+    id.clear();
+  }
+};
+
+// Parse a single SSE field line (e.g., "data: hello")
+// Returns true if this line ends an event (blank line)
+bool parse_sse_line(const std::string &line, SSEEvent &event, int &retry_ms) {
+  // Blank line signals end of event
+  if (line.empty() || line == "\r") { return true; }
+
+  // Find the colon separator
+  auto colon_pos = line.find(':');
+  if (colon_pos == std::string::npos) {
+    // Line with no colon is treated as field name with empty value
+    return false;
+  }
+
+  std::string field = line.substr(0, colon_pos);
+  std::string value;
+
+  // Value starts after colon, skip optional single space
+  if (colon_pos + 1 < line.size()) {
+    size_t value_start = colon_pos + 1;
+    if (line[value_start] == ' ') { value_start++; }
+    value = line.substr(value_start);
+    // Remove trailing \r if present
+    if (!value.empty() && value.back() == '\r') { value.pop_back(); }
+  }
+
+  // Handle known fields
+  if (field == "event") {
+    event.event = value;
+  } else if (field == "data") {
+    // Multiple data lines are concatenated with newlines
+    if (!event.data.empty()) { event.data += "\n"; }
+    event.data += value;
+  } else if (field == "id") {
+    // Empty id is valid (clears the last event ID)
+    event.id = value;
+  } else if (field == "retry") {
+    // Parse retry interval in milliseconds
+    try {
+      retry_ms = std::stoi(value);
+    } catch (...) {
+      // Invalid retry value, ignore
+    }
+  }
+  // Unknown fields are ignored per SSE spec
+
+  return false;
+}
+
+//------------------------------------------------------------------------------
+// Main - SSE Client with Auto-Reconnection
+//------------------------------------------------------------------------------
+int main(void) {
+  // Configuration
+  const std::string host = "http://localhost:1234";
+  const std::string path = "/event1";
+
+  httplib::Client cli(host);
+
+  // State for reconnection (persists across connections)
+  std::string last_event_id; // Sent as Last-Event-ID header on reconnect
+  int retry_ms = 3000; // Reconnection delay (server can override via retry:)
+  int connection_count = 0;
+
+  std::cout << "SSE Client starting...\n";
+  std::cout << "Target: " << host << path << "\n";
+  std::cout << "Press Ctrl+C to exit\n\n";
+
+  //----------------------------------------------------------------------------
+  // Main reconnection loop
+  // This mimics JavaScript's EventSource behavior:
+  // - Automatically reconnects on connection failure
+  // - Sends Last-Event-ID header to resume from last received event
+  // - Respects server's retry interval
+  //----------------------------------------------------------------------------
+  while (true) {
+    connection_count++;
+    std::cout << "[Connection #" << connection_count << "] Connecting...\n";
+
+    // Build headers, including Last-Event-ID if we have one
+    httplib::Headers headers;
+    if (!last_event_id.empty()) {
+      headers.emplace("Last-Event-ID", last_event_id);
+      std::cout << "[Connection #" << connection_count
+                << "] Resuming from event ID: " << last_event_id << "\n";
+    }
+
+    // Open streaming connection
+    auto result = httplib::stream::Get(cli, path, headers);
+
+    //--------------------------------------------------------------------------
+    // Connection error handling
+    //--------------------------------------------------------------------------
+    if (!result) {
+      std::cerr << "[Connection #" << connection_count
+                << "] Failed: " << httplib::to_string(result.error()) << "\n";
+      std::cerr << "Reconnecting in " << retry_ms << "ms...\n\n";
+      std::this_thread::sleep_for(std::chrono::milliseconds(retry_ms));
+      continue;
+    }
+
+    if (result.status() != 200) {
+      std::cerr << "[Connection #" << connection_count
+                << "] HTTP error: " << result.status() << "\n";
+
+      // For certain errors, don't reconnect
+      if (result.status() == 204 || // No Content - server wants us to stop
+          result.status() == 404 || // Not Found
+          result.status() == 401 || // Unauthorized
+          result.status() == 403) { // Forbidden
+        std::cerr << "Permanent error, not reconnecting.\n";
+        return 1;
+      }
+
+      std::cerr << "Reconnecting in " << retry_ms << "ms...\n\n";
+      std::this_thread::sleep_for(std::chrono::milliseconds(retry_ms));
+      continue;
+    }
+
+    // Verify Content-Type (optional but recommended)
+    auto content_type = result.get_header_value("Content-Type");
+    if (content_type.find("text/event-stream") == std::string::npos) {
+      std::cerr << "[Warning] Content-Type is not text/event-stream: "
+                << content_type << "\n";
+    }
+
+    std::cout << "[Connection #" << connection_count << "] Connected!\n\n";
+
+    //--------------------------------------------------------------------------
+    // Event receiving loop
+    // Reads chunks from the stream and parses SSE events
+    //--------------------------------------------------------------------------
+    std::string buffer;
+    SSEEvent current_event;
+    int event_count = 0;
+
+    // Read data from stream using httplib::stream API
+    while (result.next()) {
+      buffer.append(result.data(), result.size());
+
+      // Process complete lines in the buffer
+      size_t line_start = 0;
+      size_t newline_pos;
+
+      while ((newline_pos = buffer.find('\n', line_start)) !=
+             std::string::npos) {
+        std::string line = buffer.substr(line_start, newline_pos - line_start);
+        line_start = newline_pos + 1;
+
+        // Parse the line and check if event is complete
+        bool event_complete = parse_sse_line(line, current_event, retry_ms);
+
+        if (event_complete && !current_event.data.empty()) {
+          // Event received - process it
+          event_count++;
+
+          std::cout << "--- Event #" << event_count << " ---\n";
+          std::cout << "Type: " << current_event.event << "\n";
+          std::cout << "Data: " << current_event.data << "\n";
+          if (!current_event.id.empty()) {
+            std::cout << "ID:   " << current_event.id << "\n";
+          }
+          std::cout << "\n";
+
+          // Update last_event_id for reconnection
+          // Note: Empty id clears the last event ID per SSE spec
+          if (!current_event.id.empty()) { last_event_id = current_event.id; }
+
+          current_event.clear();
+        }
+      }
+
+      // Keep unprocessed data in buffer
+      buffer.erase(0, line_start);
+    }
+
+    //--------------------------------------------------------------------------
+    // Connection ended - check why
+    //--------------------------------------------------------------------------
+    if (result.read_error() != httplib::Error::Success) {
+      std::cerr << "\n[Connection #" << connection_count
+                << "] Error: " << httplib::to_string(result.read_error())
+                << "\n";
+    } else {
+      std::cout << "\n[Connection #" << connection_count
+                << "] Stream ended normally\n";
+    }
+
+    std::cout << "Received " << event_count << " events in this connection\n";
+    std::cout << "Reconnecting in " << retry_ms << "ms...\n\n";
+    std::this_thread::sleep_for(std::chrono::milliseconds(retry_ms));
+  }
+
+  return 0;
+}

example/ssecli.cc

@@ -1,21 +1,57 @@
 //
 //  ssecli.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 
 #include <httplib.h>
+
+#include <csignal>
 #include <iostream>
 
 using namespace std;
 
-int main(void) {
-  httplib::Client("http://localhost:1234")
-      .Get("/event1", [&](const char *data, size_t data_length) {
-        std::cout << string(data, data_length);
-        return true;
-      });
+// Global SSEClient pointer for signal handling
+httplib::sse::SSEClient *g_sse = nullptr;
 
+void signal_handler(int) {
+  if (g_sse) { g_sse->stop(); }
+}
+
+int main(void) {
+  // Configuration
+  const string host = "http://localhost:1234";
+  const string path = "/event1";
+
+  cout << "SSE Client using httplib::sse::SSEClient\n";
+  cout << "Connecting to: " << host << path << "\n";
+  cout << "Press Ctrl+C to exit\n\n";
+
+  httplib::Client cli(host);
+  httplib::sse::SSEClient sse(cli, path);
+
+  // Set up signal handler for graceful shutdown
+  g_sse = &sse;
+  signal(SIGINT, signal_handler);
+
+  // Event handlers
+  sse.on_open([]() { cout << "[Connected]\n\n"; });
+
+  sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    cout << "Event: " << msg.event << "\n";
+    cout << "Data:  " << msg.data << "\n";
+    if (!msg.id.empty()) { cout << "ID:    " << msg.id << "\n"; }
+    cout << "\n";
+  });
+
+  sse.on_error([](httplib::Error err) {
+    cerr << "[Error] " << httplib::to_string(err) << "\n";
+  });
+
+  // Start with auto-reconnect (blocking)
+  sse.start();
+
+  cout << "\n[Disconnected]\n";
   return 0;
 }

example/upload.cc

@@ -1,7 +1,7 @@
 //
 //  upload.cc
 //
-//  Copyright (c) 2019 Yuji Hirose. All rights reserved.
+//  Copyright (c) 2026 Yuji Hirose. All rights reserved.
 //  MIT License
 //
 

example/wsecho.cc

@@ -0,0 +1,135 @@
+#include <httplib.h>
+#include <iostream>
+
+using namespace httplib;
+
+const auto html = R"HTML(
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<title>WebSocket Demo</title>
+<style>
+  body { font-family: monospace; margin: 2em; }
+  #log { height: 300px; overflow-y: scroll; border: 1px solid #ccc; padding: 8px; }
+  .controls { margin: 8px 0; }
+  button { margin-right: 4px; }
+</style>
+</head>
+<body>
+<h1>WebSocket Demo</h1>
+<p>Server accepts subprotocols: <b>echo</b>, <b>chat</b> (or none)</p>
+
+<div class="controls">
+  <label>Subprotocols: </label>
+  <input id="protos" type="text" value="echo, chat" placeholder="leave empty for none" />
+  <button onclick="doConnect()">Connect</button>
+  <button onclick="doDisconnect()">Disconnect</button>
+</div>
+
+<div class="controls">
+  <input id="msg" type="text" placeholder="Type a message..." />
+  <button onclick="doSend()">Send</button>
+</div>
+
+<div class="controls">
+  <button onclick="startAuto()">Start Auto (1s)</button>
+  <button onclick="stopAuto()">Stop Auto</button>
+  <span id="auto-status"></span>
+</div>
+
+<pre id="log"></pre>
+
+<script>
+var sock = null;
+var logEl = document.getElementById("log");
+var statusEl = document.getElementById("auto-status");
+var timer = null;
+var seq = 0;
+
+function appendLog(text) {
+  logEl.textContent += text + "\n";
+  logEl.scrollTop = logEl.scrollHeight;
+}
+
+function doConnect() {
+  if (sock && sock.readyState <= 1) { sock.close(); }
+  var input = document.getElementById("protos").value.trim();
+  var protocols = input ? input.split(/\s*,\s*/).filter(Boolean) : [];
+  sock = new WebSocket("ws://" + location.host + "/ws", protocols);
+  appendLog("[connecting] proposed: " + (protocols.length ? protocols.join(", ") : "(none)"));
+  sock.onopen = function() { appendLog("[connected] subprotocol: " + (sock.protocol || "(none)")); };
+  sock.onclose = function() { appendLog("[disconnected]"); stopAuto(); };
+  sock.onmessage = function(e) { appendLog("< " + e.data); };
+}
+
+function doDisconnect() {
+  if (sock) { sock.close(); }
+}
+
+function doSend() {
+  var input = document.getElementById("msg");
+  if (!sock || sock.readyState !== 1 || input.value === "") return;
+  sock.send(input.value);
+  appendLog("> " + input.value);
+  input.value = "";
+}
+
+function startAuto() {
+  if (timer || !sock || sock.readyState !== 1) return;
+  seq = 0;
+  statusEl.textContent = "running...";
+  timer = setInterval(function() {
+    if (!sock || sock.readyState !== 1) { stopAuto(); return; }
+    var msg = "auto #" + seq++;
+    sock.send(msg);
+    appendLog("> " + msg);
+  }, 1000);
+}
+
+function stopAuto() {
+  if (timer) { clearInterval(timer); timer = null; }
+  statusEl.textContent = "";
+}
+
+document.getElementById("msg").addEventListener("keydown", function(e) {
+  if (e.key === "Enter") doSend();
+});
+
+doConnect();
+</script>
+</body>
+</html>
+)HTML";
+
+int main(void) {
+  Server svr;
+
+  svr.Get("/", [&](const Request & /*req*/, Response &res) {
+    res.set_content(html, "text/html");
+  });
+
+  svr.WebSocket(
+      "/ws",
+      [](const Request &req, ws::WebSocket &ws) {
+        std::cout << "WebSocket connected from " << req.remote_addr
+                  << std::endl;
+
+        std::string msg;
+        while (ws.read(msg)) {
+          std::cout << "Received: " << msg << std::endl;
+          ws.send("echo: " + msg);
+        }
+
+        std::cout << "WebSocket disconnected" << std::endl;
+      },
+      [](const std::vector<std::string> &protocols) -> std::string {
+        for (const auto &p : protocols) {
+          if (p == "echo" || p == "chat") { return p; }
+        }
+        return "";
+      });
+
+  std::cout << "Listening on http://localhost:8080" << std::endl;
+  svr.listen("localhost", 8080);
+}

generate_module.py

@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+
+"""This script generates httplib.cppm module file from httplib.h."""
+
+import os
+import sys
+from argparse import ArgumentParser, Namespace
+from typing import List
+
+def main() -> None:
+    """Main entry point for the script."""
+
+    args_parser: ArgumentParser = ArgumentParser(description=__doc__)
+    args_parser.add_argument(
+        "-o", "--out", help="where to write the files (default: out)", default="out"
+    )
+    args: Namespace = args_parser.parse_args()
+
+    cur_dir: str = os.path.dirname(sys.argv[0])
+    if not cur_dir:
+        cur_dir = '.'
+    lib_name: str = "httplib"
+    header_name: str = f"/{lib_name}.h"
+    # get the input file
+    in_file: str = f"{cur_dir}{header_name}"
+    # get the output file
+    cppm_out: str = f"{args.out}/{lib_name}.cppm"
+
+    # if the modification time of the out file is after the in file,
+    # don't generate (as it is already finished)
+    do_generate: bool = True
+
+    if os.path.exists(cppm_out):
+        in_time: float = os.path.getmtime(in_file)
+        out_time: float = os.path.getmtime(cppm_out)
+        do_generate: bool = in_time > out_time
+
+    if do_generate:
+        with open(in_file) as f:
+            lines: List[str] = f.readlines()
+
+        os.makedirs(args.out, exist_ok=True)
+
+        # Find the Headers and Declaration comment markers
+        headers_start: int = -1
+        declaration_start: int = -1
+        for i, line in enumerate(lines):
+            if ' * Headers' in line:
+                headers_start = i - 1  # Include the /* line
+            elif ' * Declaration' in line:
+                declaration_start = i - 1  # Stop before the /* line
+                break
+
+        with open(cppm_out, 'w') as fm:
+            # Write module file
+            fm.write("module;\n\n")
+            
+            # Write global module fragment (from Headers to Declaration comment)
+            # Filter out 'using' declarations to avoid conflicts
+            if headers_start >= 0 and declaration_start >= 0:
+                for i in range(headers_start, declaration_start):
+                    line: str = lines[i]
+                    if 'using' not in line:
+                        fm.write(line)
+            
+            fm.write("\nexport module httplib;\n\n")
+            fm.write("export extern \"C++\" {\n")
+            fm.write(f"{' ' * 4}#include \"httplib.h\"\n")
+            fm.write("}\n")
+
+        print(f"Wrote {cppm_out}")
+    else:
+        print(f"{cppm_out} is up to date")
+
+
+if __name__ == "__main__":
+    main()

justfile

@@ -0,0 +1,56 @@
+set shell := ["bash", "-c"]
+
+default: list
+
+list:
+    @just --list --unsorted
+
+openssl:
+    @(cd test && LSAN_OPTIONS=suppressions=lsan_suppressions.txt make)
+    @(cd test && make proxy)
+
+openssl_parallel:
+    @(cd test && make test_openssl_parallel)
+
+mbedtls:
+    @(cd test && make test_mbedtls && LSAN_OPTIONS=suppressions=lsan_suppressions.txt ./test_mbedtls)
+    @(cd test && make proxy_mbedtls)
+
+mbedtls_parallel:
+    @(cd test && make test_mbedtls_parallel)
+
+wolfssl:
+    @(cd test && make test_wolfssl && LSAN_OPTIONS=suppressions=lsan_suppressions.txt ./test_wolfssl)
+    @(cd test && make proxy_wolfssl)
+
+wolfssl_parallel:
+    @(cd test && make test_wolfssl_parallel)
+
+no_tls:
+    @(cd test && make test_no_tls && ./test_no_tls)
+
+no_tls_parallel:
+    @(cd test && make test_no_tls_parallel)
+
+others:
+    @(cd test && make fuzz_test)
+    @(cd test && make test_websocket_heartbeat && ./test_websocket_heartbeat)
+    @(cd test && make test_thread_pool && ./test_thread_pool)
+    @(cd test && make test_benchmark && ./test_benchmark)
+
+build:
+    @(cd test && make test_split)
+    @(cd test && make test_split_mbedtls)
+    @(cd test && make test_split_wolfssl)
+
+bench:
+    @(cd benchmark && make bench-all)
+
+docs:
+    @cargo build --release --manifest-path docs-gen/Cargo.toml
+    @./docs-gen/target/release/docs-gen build docs-src --out docs
+
+docs-serve:
+    @cargo build --release --manifest-path docs-gen/Cargo.toml
+    -@./docs-gen/target/release/docs-gen serve docs-src --open
+

meson.build

@@ -39,16 +39,36 @@ endif
 deps = [dependency('threads')]
 args = []
 
-openssl_dep = dependency('openssl', version: '>=3.0.0', required: get_option('openssl'))
-if openssl_dep.found()
-  deps += openssl_dep
-  args += '-DCPPHTTPLIB_OPENSSL_SUPPORT'
-  if host_machine.system() == 'darwin'
-    macosx_keychain_dep = dependency('appleframeworks', modules: ['CoreFoundation', 'Security'], required: get_option('macosx_keychain'))
-    if macosx_keychain_dep.found()
+if get_option('tls').allowed()
+  tls_found = false
+  if get_option('tls_backend') == 'openssl'
+    openssl_dep = dependency('openssl', version: '>=3.0.0', required: get_option('tls'))
+    if openssl_dep.found()
+      deps += openssl_dep
+      args += '-DCPPHTTPLIB_OPENSSL_SUPPORT'
+      tls_found = true
+    endif
+  else
+    mbedtls_dep = dependency('mbedtls', required: get_option('tls'))
+    mbedtlsx509_dep = dependency('mbedx509', required: get_option('tls'))
+    mbedtlscrypto_dep = dependency('mbedcrypto', required: get_option('tls'))
+    if mbedtls_dep.found() and mbedtlsx509_dep.found() and mbedtlscrypto_dep.found()
+      deps += mbedtls_dep
+      deps += mbedtlsx509_dep
+      deps += mbedtlscrypto_dep
+      args += '-DCPPHTTPLIB_MBEDTLS_SUPPORT'
+      tls_found = true
+    endif
+  endif
+
+  if tls_found and host_machine.system() == 'darwin'
+    disable_macosx_certs = get_option('disable_macosx_automatic_root_certificates')
+    if disable_macosx_certs
+        args += '-DCPPHTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES'
+    else
+        macosx_keychain_dep = dependency('appleframeworks', modules: ['CFNetwork', 'CoreFoundation', 'Security'], required: true)
         deps += macosx_keychain_dep
-        args += '-DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN'
-    endif  
+    endif
   endif
 endif
 
@@ -74,12 +94,18 @@ if brotli_found_all
   args += '-DCPPHTTPLIB_BROTLI_SUPPORT'
 endif
 
+zstd_dep = dependency('libzstd', required: get_option('zstd'))
+if zstd_dep.found()
+  deps += zstd_dep
+  args += '-DCPPHTTPLIB_ZSTD_SUPPORT'
+endif
+
 async_ns_opt = get_option('non_blocking_getaddrinfo')
 
 if host_machine.system() == 'windows'
   async_ns_dep = cxx.find_library('ws2_32', required: async_ns_opt)
 elif host_machine.system() == 'darwin'
-  async_ns_dep = dependency('appleframeworks', modules: ['CFNetwork'], required: async_ns_opt)
+  async_ns_dep = dependency('appleframeworks', modules: ['CFNetwork', 'CoreFoundation'], required: async_ns_opt)
 else
   async_ns_dep = cxx.find_library('anl', required: async_ns_opt)
 endif

meson_options.txt

@@ -2,18 +2,22 @@
 #
 # SPDX-License-Identifier: MIT
 
-option('openssl', type: 'feature', value: 'auto', description: 'Enable OpenSSL support')
+option('tls',     type: 'feature', description: 'Enable TLS support')
+option('tls_backend', type: 'combo', choices: ['openssl', 'mbedtls'], value: 'openssl', description: 'Which TLS library to use')
 option('zlib',    type: 'feature', value: 'auto', description: 'Enable zlib support')
 option('brotli',  type: 'feature', value: 'auto', description: 'Enable Brotli support')
-option('macosx_keychain', type: 'feature', value: 'auto', description: 'Enable loading certs from the Keychain on Apple devices')
+option('zstd',    type: 'feature', value: 'auto', description: 'Enable zstd support')
+option('disable_macosx_automatic_root_certificates', type: 'boolean', value: false, description: 'Disable loading system certs from the Apple Keychain on macOS')
 option('non_blocking_getaddrinfo', type: 'feature', value: 'auto', description: 'Enable asynchronous name lookup')
 option('compile', type: 'boolean', value: false,  description: 'Split the header into a compilable header & source file (requires python3)')
 option('test',    type: 'boolean', value: false,  description: 'Build tests')
 
 # Old option names
+option('openssl', type: 'feature', deprecated: 'tls')
 option('cpp-httplib_openssl', type: 'feature', deprecated: 'openssl')
 option('cpp-httplib_zlib',    type: 'feature', deprecated: 'zlib')
 option('cpp-httplib_brotli',  type: 'feature', deprecated: 'brotli')
+option('macosx_keychain', type: 'feature', deprecated: true, description: 'Deprecated: use disable_macosx_automatic_root_certificates instead')
 option('cpp-httplib_macosx_keychain', type: 'feature', deprecated: 'macosx_keychain')
 option('cpp-httplib_non_blocking_getaddrinfo', type: 'feature', deprecated: 'non_blocking_getaddrinfo')
 option('cpp-httplib_compile', type: 'boolean', value: false, deprecated: 'compile')

split.py

@@ -2,66 +2,76 @@
 
 """This script splits httplib.h into .h and .cc parts."""
 
-import argparse
 import os
 import sys
+from argparse import ArgumentParser, Namespace
+from typing import List
 
-border = '// ----------------------------------------------------------------------------'
+BORDER: str = '// ----------------------------------------------------------------------------'
 
-args_parser = argparse.ArgumentParser(description=__doc__)
-args_parser.add_argument(
-    "-e", "--extension", help="extension of the implementation file (default: cc)",
-    default="cc"
-)
-args_parser.add_argument(
-    "-o", "--out", help="where to write the files (default: out)", default="out"
-)
-args = args_parser.parse_args()
+def main() -> None:
+    """Main entry point for the script."""
 
-cur_dir = os.path.dirname(sys.argv[0])
-lib_name = 'httplib'
-header_name = '/' + lib_name + '.h'
-source_name = '/' + lib_name + '.' + args.extension
-# get the input file
-in_file = cur_dir + header_name
-# get the output file
-h_out = args.out + header_name
-cc_out = args.out + source_name
+    args_parser: ArgumentParser = ArgumentParser(description=__doc__)
+    args_parser.add_argument(
+        "-e", "--extension", help="extension of the implementation file (default: cc)", default="cc"
+    )
+    args_parser.add_argument(
+        "-o", "--out", help="where to write the files (default: out)", default="out"
+    )
+    args: Namespace = args_parser.parse_args()
 
-# if the modification time of the out file is after the in file,
-# don't split (as it is already finished)
-do_split = True
+    cur_dir: str = os.path.dirname(sys.argv[0])
+    if not cur_dir:
+        cur_dir = '.'
+    lib_name: str = "httplib"
+    header_name: str = f"/{lib_name}.h"
+    source_name: str = f"/{lib_name}.{args.extension}"
+    # get the input file
+    in_file: str = f"{cur_dir}{header_name}"
+    # get the output file
+    h_out: str = f"{args.out}{header_name}"
+    cc_out: str = f"{args.out}{source_name}"
 
-if os.path.exists(h_out):
-    in_time = os.path.getmtime(in_file)
-    out_time = os.path.getmtime(h_out)
-    do_split = in_time > out_time
+    # if the modification time of the out file is after the in file,
+    # don't split (as it is already finished)
+    do_split: bool = True
 
-if do_split:
-    with open(in_file) as f:
-        lines = f.readlines()
+    if os.path.exists(h_out):
+        in_time: float = os.path.getmtime(in_file)
+        out_time: float = os.path.getmtime(h_out)
+        do_split: bool = in_time > out_time
+
+    if do_split:
+        with open(in_file) as f:
+            lines: List[str] = f.readlines()
 
-    python_version = sys.version_info[0]
-    if python_version < 3:
-        os.makedirs(args.out)
-    else:
         os.makedirs(args.out, exist_ok=True)
 
-    in_implementation = False
-    cc_out = args.out + source_name
-    with open(h_out, 'w') as fh, open(cc_out, 'w') as fc:
-        fc.write('#include "httplib.h"\n')
-        fc.write('namespace httplib {\n')
-        for line in lines:
-            is_border_line = border in line
-            if is_border_line:
-                in_implementation = not in_implementation
-            elif in_implementation:
-                fc.write(line.replace('inline ', ''))
-            else:
-                fh.write(line)
-        fc.write('} // namespace httplib\n')
+        in_implementation: bool = False
+        cc_out: str = args.out + source_name
+        
+        with open(h_out, 'w') as fh, open(cc_out, 'w') as fc:
+            # Write source file
+            fc.write("#include \"httplib.h\"\n")
+            fc.write("namespace httplib {\n")
+            
+            # Process lines for header and source split
+            for line in lines:
+                is_border_line: bool = BORDER in line
+                if is_border_line:
+                    in_implementation: bool = not in_implementation
+                elif in_implementation:
+                    fc.write(line.replace("inline ", ""))
+                else:
+                    fh.write(line)
+            
+            fc.write("} // namespace httplib\n")
 
-    print("Wrote {} and {}".format(h_out, cc_out))
-else:
-    print("{} and {} are up to date".format(h_out, cc_out))
+        print(f"Wrote {h_out} and {cc_out}")
+    else:
+        print(f"{h_out} and {cc_out} are up to date")
+
+
+if __name__ == "__main__":
+    main()

test/Makefile

@@ -1,38 +1,49 @@
 CXX = clang++
-CXXFLAGS = -g -std=c++11 -I. -Wall -Wextra -Wtype-limits -Wconversion -Wshadow $(EXTRA_CXXFLAGS) -DCPPHTTPLIB_USE_NON_BLOCKING_GETADDRINFO # -fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS -fsanitize=address
-
-PREFIX ?= $(shell brew --prefix)
-
-OPENSSL_DIR = $(PREFIX)/opt/openssl@3
-OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -I$(OPENSSL_DIR)/include -L$(OPENSSL_DIR)/lib -lssl -lcrypto
+CXXFLAGS = -g -std=c++11 -I. -Wall -Wextra -Wtype-limits -Wconversion -Wshadow $(EXTRA_CXXFLAGS) -DCPPHTTPLIB_USE_NON_BLOCKING_GETADDRINFO -fsanitize=address # -fno-exceptions -DCPPHTTPLIB_NO_EXCEPTIONS
 
 ifneq ($(OS), Windows_NT)
 	UNAME_S := $(shell uname -s)
 	ifeq ($(UNAME_S), Darwin)
-		OPENSSL_SUPPORT += -DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN -framework Security
+		PREFIX ?= $(shell brew --prefix)
+		OPENSSL_DIR = $(PREFIX)/opt/openssl@3
+		OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -I$(OPENSSL_DIR)/include -L$(OPENSSL_DIR)/lib -lssl -lcrypto
+		OPENSSL_SUPPORT += -framework CoreFoundation -framework Security
+		MBEDTLS_DIR ?= $(shell brew --prefix mbedtls@3)
+		MBEDTLS_SUPPORT = -DCPPHTTPLIB_MBEDTLS_SUPPORT -I$(MBEDTLS_DIR)/include -L$(MBEDTLS_DIR)/lib -lmbedtls -lmbedx509 -lmbedcrypto
+		MBEDTLS_SUPPORT += -framework CoreFoundation -framework Security
+		WOLFSSL_DIR ?= $(shell brew --prefix wolfssl)
+		WOLFSSL_SUPPORT = -DCPPHTTPLIB_WOLFSSL_SUPPORT -I$(WOLFSSL_DIR)/include -I$(WOLFSSL_DIR)/include/wolfssl -L$(WOLFSSL_DIR)/lib -lwolfssl
+		WOLFSSL_SUPPORT += -framework CoreFoundation -framework Security
+	else
+		OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -lssl -lcrypto
+		MBEDTLS_SUPPORT = -DCPPHTTPLIB_MBEDTLS_SUPPORT -lmbedtls -lmbedx509 -lmbedcrypto
+		WOLFSSL_SUPPORT = -DCPPHTTPLIB_WOLFSSL_SUPPORT -lwolfssl
 	endif
 endif
 
 ZLIB_SUPPORT = -DCPPHTTPLIB_ZLIB_SUPPORT -lz
 
-BROTLI_DIR = $(PREFIX)/opt/brotli
-BROTLI_SUPPORT = -DCPPHTTPLIB_BROTLI_SUPPORT -I$(BROTLI_DIR)/include -L$(BROTLI_DIR)/lib -lbrotlicommon -lbrotlienc -lbrotlidec
-
-ZSTD_DIR = $(PREFIX)/opt/zstd
-ZSTD_SUPPORT = -DCPPHTTPLIB_ZSTD_SUPPORT -I$(ZSTD_DIR)/include -L$(ZSTD_DIR)/lib -lzstd
-
-LIBS = -lpthread -lcurl
 ifneq ($(OS), Windows_NT)
 	UNAME_S := $(shell uname -s)
 	ifeq ($(UNAME_S), Darwin)
-		LIBS += -framework CoreFoundation -framework CFNetwork
-	endif
-	ifneq ($(UNAME_S), Darwin)
-		LIBS += -lanl
+		# macOS: use Homebrew paths for brotli and zstd
+		BROTLI_DIR = $(PREFIX)/opt/brotli
+		BROTLI_SUPPORT = -DCPPHTTPLIB_BROTLI_SUPPORT -I$(BROTLI_DIR)/include -L$(BROTLI_DIR)/lib -lbrotlicommon -lbrotlienc -lbrotlidec
+		ZSTD_DIR = $(PREFIX)/opt/zstd
+		ZSTD_SUPPORT = -DCPPHTTPLIB_ZSTD_SUPPORT -I$(ZSTD_DIR)/include -L$(ZSTD_DIR)/lib -lzstd
+		LIBS = -lpthread -lcurl -framework CoreFoundation -framework CFNetwork
+	else
+		# Linux: use system paths
+		BROTLI_SUPPORT = -DCPPHTTPLIB_BROTLI_SUPPORT -lbrotlicommon -lbrotlienc -lbrotlidec
+		ZSTD_SUPPORT = -DCPPHTTPLIB_ZSTD_SUPPORT -lzstd
+		LIBS = -lpthread -lcurl -lanl
 	endif
 endif
 
 TEST_ARGS = gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include $(OPENSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT) $(ZSTD_SUPPORT) $(LIBS)
+TEST_ARGS_MBEDTLS = gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include $(MBEDTLS_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT) $(ZSTD_SUPPORT) $(LIBS)
+TEST_ARGS_WOLFSSL = gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include $(WOLFSSL_SUPPORT) $(ZLIB_SUPPORT) $(BROTLI_SUPPORT) $(ZSTD_SUPPORT) $(LIBS)
+TEST_ARGS_NO_TLS = gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include $(ZLIB_SUPPORT) $(BROTLI_SUPPORT) $(ZSTD_SUPPORT) $(LIBS)
 
 # By default, use standalone_fuzz_target_runner.
 # This runner does no fuzzing, but simply executes the inputs
@@ -48,7 +59,46 @@ STYLE_CHECK_FILES = $(filter-out httplib.h httplib.cc, \
 	$(wildcard example/*.h example/*.cc fuzzing/*.h fuzzing/*.cc *.h *.cc ../httplib.h))
 
 all : test test_split
-	./test
+	LSAN_OPTIONS=suppressions=lsan_suppressions.txt ./test
+
+SHARDS ?= 4
+
+define run_parallel
+	@echo "Running $(1) with $(SHARDS) shards in parallel..."
+	@fail=0; \
+	for i in $$(seq 0 $$(($(SHARDS) - 1))); do \
+	  GTEST_TOTAL_SHARDS=$(SHARDS) GTEST_SHARD_INDEX=$$i \
+	  LSAN_OPTIONS=suppressions=lsan_suppressions.txt \
+	  ./$(1) --gtest_color=yes > $(1)_shard_$$i.log 2>&1 & \
+	done; \
+	wait; \
+	for i in $$(seq 0 $$(($(SHARDS) - 1))); do \
+	  if ! grep -q "\[  PASSED  \]" $(1)_shard_$$i.log; then \
+	    echo "=== Shard $$i FAILED ==="; \
+	    cat $(1)_shard_$$i.log; \
+	    fail=1; \
+	  else \
+	    passed=$$(grep "\[  PASSED  \]" $(1)_shard_$$i.log); \
+	    echo "Shard $$i: $$passed"; \
+	  fi; \
+	done; \
+	if [ $$fail -ne 0 ]; then exit 1; fi; \
+	echo "All shards passed."
+endef
+
+.PHONY: test_openssl_parallel test_mbedtls_parallel test_wolfssl_parallel test_no_tls_parallel
+
+test_openssl_parallel : test
+	$(call run_parallel,test)
+
+test_mbedtls_parallel : test_mbedtls
+	$(call run_parallel,test_mbedtls)
+
+test_wolfssl_parallel : test_wolfssl
+	$(call run_parallel,test_wolfssl)
+
+test_no_tls_parallel : test_no_tls
+	$(call run_parallel,test_no_tls)
 
 proxy : test_proxy
 	@echo "Starting proxy server..."
@@ -69,6 +119,44 @@ proxy : test_proxy
 	cd proxy && docker compose down; \
 	exit $$exit_code
 
+proxy_mbedtls : test_proxy_mbedtls
+	@echo "Starting proxy server..."
+	cd proxy && \
+	docker compose up -d
+	@echo "Waiting for proxy to be ready..."
+	@until nc -z localhost 3128 && nc -z localhost 3129; do sleep 1; done
+	@echo "Proxy servers are ready, waiting additional 5 seconds for full startup..."
+	@sleep 5
+	@echo "Checking proxy server status..."
+	@cd proxy && docker compose ps
+	@echo "Checking proxy server logs..."
+	@cd proxy && docker compose logs --tail=20
+	@echo "Running proxy tests (Mbed TLS)..."
+	./test_proxy_mbedtls; \
+	exit_code=$$?; \
+	echo "Stopping proxy server..."; \
+	cd proxy && docker compose down; \
+	exit $$exit_code
+
+proxy_wolfssl : test_proxy_wolfssl
+	@echo "Starting proxy server..."
+	cd proxy && \
+	docker compose up -d
+	@echo "Waiting for proxy to be ready..."
+	@until nc -z localhost 3128 && nc -z localhost 3129; do sleep 1; done
+	@echo "Proxy servers are ready, waiting additional 5 seconds for full startup..."
+	@sleep 5
+	@echo "Checking proxy server status..."
+	@cd proxy && docker compose ps
+	@echo "Checking proxy server logs..."
+	@cd proxy && docker compose logs --tail=20
+	@echo "Running proxy tests (wolfSSL)..."
+	./test_proxy_wolfssl; \
+	exit_code=$$?; \
+	echo "Stopping proxy server..."; \
+	cd proxy && docker compose down; \
+	exit $$exit_code
+
 test : test.cc include_httplib.cc ../httplib.h Makefile cert.pem
 	$(CXX) -o $@ -I.. $(CXXFLAGS) test.cc include_httplib.cc $(TEST_ARGS)
 	@file $@
@@ -78,6 +166,34 @@ test : test.cc include_httplib.cc ../httplib.h Makefile cert.pem
 test_split : test.cc ../httplib.h httplib.cc Makefile cert.pem
 	$(CXX) -o $@ $(CXXFLAGS) test.cc httplib.cc $(TEST_ARGS)
 
+# Mbed TLS backend targets
+test_mbedtls : test.cc include_httplib.cc ../httplib.h Makefile cert.pem
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test.cc include_httplib.cc $(TEST_ARGS_MBEDTLS)
+	@file $@
+
+test_split_mbedtls : test.cc ../httplib.h httplib.cc Makefile cert.pem
+	$(CXX) -o $@ $(CXXFLAGS) test.cc httplib.cc $(TEST_ARGS_MBEDTLS)
+
+# wolfSSL backend targets
+test_wolfssl : test.cc include_httplib.cc ../httplib.h Makefile cert.pem
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test.cc include_httplib.cc $(TEST_ARGS_WOLFSSL)
+	@file $@
+
+test_split_wolfssl : test.cc ../httplib.h httplib.cc Makefile cert.pem
+	$(CXX) -o $@ $(CXXFLAGS) test.cc httplib.cc $(TEST_ARGS_WOLFSSL)
+
+# No TLS
+test_no_tls : test.cc include_httplib.cc ../httplib.h Makefile
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test.cc include_httplib.cc $(TEST_ARGS_NO_TLS)
+	@file $@
+
+test_split_no_tls : test.cc ../httplib.h httplib.cc Makefile
+	$(CXX) -o $@ $(CXXFLAGS) test.cc httplib.cc $(TEST_ARGS_NO_TLS)
+
+# ThreadPool unit tests (no TLS, no compression needed)
+test_thread_pool : test_thread_pool.cc ../httplib.h Makefile
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test_thread_pool.cc gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include -lpthread
+
 check_abi:
 	@./check-shared-library-abi-compatibility.sh
 
@@ -103,9 +219,29 @@ style_check: $(STYLE_CHECK_FILES)
 		echo "All files are properly formatted."; \
 	fi
 
+BENCHMARK_LIBS = -lpthread
+ifneq ($(OS), Windows_NT)
+	ifeq ($(shell uname -s), Darwin)
+		BENCHMARK_LIBS += -framework CoreFoundation -framework CFNetwork
+	endif
+endif
+
+test_benchmark : test_benchmark.cc ../httplib.h Makefile
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test_benchmark.cc gtest/src/gtest-all.cc gtest/src/gtest_main.cc -Igtest -Igtest/include $(BENCHMARK_LIBS)
+
+test_websocket_heartbeat : test_websocket_heartbeat.cc ../httplib.h Makefile
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test_websocket_heartbeat.cc $(TEST_ARGS)
+	@file $@
+
 test_proxy : test_proxy.cc ../httplib.h Makefile cert.pem
 	$(CXX) -o $@ -I.. $(CXXFLAGS) test_proxy.cc $(TEST_ARGS)
 
+test_proxy_mbedtls : test_proxy.cc ../httplib.h Makefile cert.pem
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test_proxy.cc $(TEST_ARGS_MBEDTLS)
+
+test_proxy_wolfssl : test_proxy.cc ../httplib.h Makefile cert.pem
+	$(CXX) -o $@ -I.. $(CXXFLAGS) test_proxy.cc $(TEST_ARGS_WOLFSSL)
+
 # Runs server_fuzzer.cc based on value of $(LIB_FUZZING_ENGINE).
 # Usage: make fuzz_test LIB_FUZZING_ENGINE=/path/to/libFuzzer
 fuzz_test: server_fuzzer
@@ -128,5 +264,5 @@ cert.pem:
 	./gen-certs.sh
 
 clean:
-	rm -rf test test_split test_proxy server_fuzzer *.pem *.0 *.o *.1 *.srl httplib.h httplib.cc _build* *.dSYM
+	rm -rf test test_split test_mbedtls test_split_mbedtls test_wolfssl test_split_wolfssl test_no_tls, test_split_no_tls test_proxy test_proxy_mbedtls test_proxy_wolfssl test_benchmark server_fuzzer *.pem *.0 *.o *.1 *.srl httplib.h httplib.cc _build* *.dSYM *_shard_*.log cpp-httplib
 

test/gen-certs.sh

@@ -14,5 +14,5 @@ openssl genrsa 2048 > client.key.pem
 openssl req -new -batch -config test.conf -key client.key.pem | openssl x509 -days 370 -req -CA rootCA.cert.pem -CAkey rootCA.key.pem -CAcreateserial > client.cert.pem
 openssl genrsa -passout pass:test123! 2048 > key_encrypted.pem
 openssl req -new -batch -config test.conf -key key_encrypted.pem | openssl x509 -days 3650 -req -signkey key_encrypted.pem > cert_encrypted.pem
-openssl genrsa -aes256 -passout pass:test012! 2048 > client_encrypted.key.pem
+openssl genrsa 2048 | openssl pkcs8 -topk8 -v1 PBE-SHA1-3DES -passout pass:test012! -out client_encrypted.key.pem
 openssl req -new -batch -config test.conf -key client_encrypted.key.pem -passin pass:test012! | openssl x509 -days 370 -req -CA rootCA.cert.pem -CAkey rootCA.key.pem -CAcreateserial > client_encrypted.cert.pem

test/gtest/include/gtest/gtest-printers.h

@@ -993,7 +993,7 @@ void UniversalTersePrint(const T& value, ::std::ostream* os) {
 // NUL-terminated string.
 template <typename T>
 void UniversalPrint(const T& value, ::std::ostream* os) {
-  // A workarond for the bug in VC++ 7.1 that prevents us from instantiating
+  // A workaround for the bug in VC++ 7.1 that prevents us from instantiating
   // UniversalPrinter with T directly.
   typedef T T1;
   UniversalPrinter<T1>::Print(value, os);

test/gtest/include/gtest/internal/gtest-param-util.h

@@ -753,7 +753,7 @@ class ParameterizedTestSuiteRegistry {
 };
 
 // Keep track of what type-parameterized test suite are defined and
-// where as well as which are intatiated. This allows susequently
+// where as well as which are intatiated. This allows subsequently
 // identifying suits that are defined but never used.
 class TypeParameterizedTestSuiteRegistry {
  public:
@@ -764,7 +764,7 @@ class TypeParameterizedTestSuiteRegistry {
   // Add an instantiation of a suit.
   void RegisterInstantiation(const char* test_suite_name);
 
-  // For each suit repored as defined but not reported as instantiation,
+  // For each suit reported as defined but not reported as instantiation,
   // emit a test that reports that fact (configurably, as an error).
   void CheckForInstantiations();
 

test/lsan_suppressions.txt

@@ -0,0 +1,3 @@
+# OpenSSL 3.x internal caches (provider, cipher, keymgmt) are allocated
+# lazily and intentionally kept until process exit. These are not real leaks.
+leak:libcrypto

test/proxy/basic_squid.conf

@@ -15,6 +15,7 @@ acl localnet src fc00::/7       	# RFC 4193 local private network range
 acl localnet src fe80::/10      	# RFC 4291 link-local (directly plugged) machines
 
 acl SSL_ports port 443
+acl SSL_ports port 1025-65535
 acl Safe_ports port 80		# http
 acl Safe_ports port 21		# ftp
 acl Safe_ports port 443		# https

test/proxy/digest_squid.conf

@@ -15,6 +15,7 @@ acl localnet src fc00::/7       	# RFC 4193 local private network range
 acl localnet src fe80::/10      	# RFC 4291 link-local (directly plugged) machines
 
 acl SSL_ports port 443
+acl SSL_ports port 1025-65535
 acl Safe_ports port 80		# http
 acl Safe_ports port 21		# ftp
 acl Safe_ports port 443		# https

test/proxy/docker-compose.ci.yml

@@ -0,0 +1,8 @@
+services:
+  squid_basic:
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
+  squid_digest:
+    extra_hosts:
+      - "host.docker.internal:host-gateway"

test/test_32bit_build.cpp

@@ -0,0 +1,9 @@
+#include "../httplib.h"
+
+int main() {
+  httplib::Server svr;
+  httplib::Client cli("localhost", 8080);
+  (void)svr;
+  (void)cli;
+  return 0;
+}

test/test_benchmark.cc

@@ -0,0 +1,78 @@
+#include <httplib.h>
+
+#include <gtest/gtest.h>
+
+#include <algorithm>
+#include <chrono>
+#include <sstream>
+#include <thread>
+#include <vector>
+
+using namespace httplib;
+
+static const int PORT = 11134;
+
+static void performance_test(const char *host) {
+  Server svr;
+
+  svr.Get("/benchmark", [&](const Request & /*req*/, Response &res) {
+    res.set_content("Benchmark Response", "text/plain");
+  });
+
+  auto listen_thread = std::thread([&]() { svr.listen(host, PORT); });
+  auto se = detail::scope_exit([&] {
+    svr.stop();
+    listen_thread.join();
+    ASSERT_FALSE(svr.is_running());
+  });
+
+  svr.wait_until_ready();
+
+  Client cli(host, PORT);
+
+  // Warm-up request to establish connection and resolve DNS
+  auto warmup_res = cli.Get("/benchmark");
+  ASSERT_TRUE(warmup_res); // Ensure server is responding correctly
+
+  // Run multiple trials and collect timings
+  const int num_trials = 20;
+  std::vector<int64_t> timings;
+  timings.reserve(num_trials);
+
+  for (int i = 0; i < num_trials; i++) {
+    auto start = std::chrono::high_resolution_clock::now();
+    auto res = cli.Get("/benchmark");
+    auto end = std::chrono::high_resolution_clock::now();
+
+    auto elapsed =
+        std::chrono::duration_cast<std::chrono::milliseconds>(end - start)
+            .count();
+
+    // Assertions after timing measurement to avoid overhead
+    ASSERT_TRUE(res);
+    EXPECT_EQ(StatusCode::OK_200, res->status);
+
+    timings.push_back(elapsed);
+  }
+
+  // Calculate 25th percentile (lower quartile)
+  std::sort(timings.begin(), timings.end());
+  auto p25 = timings[num_trials / 4];
+
+  // Format timings for output
+  std::ostringstream timings_str;
+  timings_str << "[";
+  for (size_t i = 0; i < timings.size(); i++) {
+    if (i > 0) timings_str << ", ";
+    timings_str << timings[i];
+  }
+  timings_str << "]";
+
+  // Localhost HTTP GET should be fast even in CI environments
+  EXPECT_LE(p25, 5) << "25th percentile performance is too slow: " << p25
+                    << "ms (Issue #1777). Timings: " << timings_str.str();
+}
+
+TEST(BenchmarkTest, localhost) { performance_test("localhost"); }
+
+TEST(BenchmarkTest, v6) { performance_test("::1"); }

test/test_proxy.cc

@@ -26,7 +26,7 @@ TEST(ProxyTest, NoSSLBasic) {
   ProxyTest(cli, true);
 }
 
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(ProxyTest, SSLBasic) {
   SSLClient cli("nghttp2.org");
   ProxyTest(cli, true);
@@ -51,7 +51,7 @@ void RedirectProxyText(T &cli, const char *path, bool basic) {
   if (basic) {
     cli.set_proxy_basic_auth("hello", "world");
   } else {
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
     cli.set_proxy_digest_auth("hello", "world");
 #endif
   }
@@ -67,7 +67,7 @@ TEST(RedirectTest, HTTPBinNoSSLBasic) {
   RedirectProxyText(cli, "/httpbin/redirect/2", true);
 }
 
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(RedirectTest, HTTPBinNoSSLDigest) {
   Client cli("nghttp2.org");
   RedirectProxyText(cli, "/httpbin/redirect/2", false);
@@ -84,7 +84,7 @@ TEST(RedirectTest, HTTPBinSSLDigest) {
 }
 #endif
 
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(RedirectTest, YouTubeNoSSLBasic) {
   Client cli("youtube.com");
   RedirectProxyText(cli, "/", true);
@@ -109,6 +109,55 @@ TEST(RedirectTest, YouTubeSSLDigest) {
 
 // ----------------------------------------------------------------------------
 
+#ifdef CPPHTTPLIB_SSL_ENABLED
+TEST(RedirectTest, TLSVerificationOnProxyRedirect) {
+  // Untrusted HTTPS server with self-signed cert
+  SSLServer untrusted_svr("cert.pem", "key.pem");
+  untrusted_svr.Get("/", [](const Request &, Response &res) {
+    res.set_content("MITM'd", "text/plain");
+  });
+
+  auto untrusted_port = untrusted_svr.bind_to_any_port("0.0.0.0");
+  auto t1 = thread([&]() { untrusted_svr.listen_after_bind(); });
+  auto se1 = detail::scope_exit([&] {
+    untrusted_svr.stop();
+    t1.join();
+  });
+
+  // HTTP server that redirects to the untrusted HTTPS server
+  // Use host.docker.internal so the proxy container can reach the host
+  Server redirect_svr;
+  redirect_svr.Get("/", [&](const Request &, Response &res) {
+    res.set_redirect(
+        "https://host.docker.internal:" + to_string(untrusted_port) + "/");
+  });
+
+  auto redirect_port = redirect_svr.bind_to_any_port("0.0.0.0");
+  auto t2 = thread([&]() { redirect_svr.listen_after_bind(); });
+  auto se2 = detail::scope_exit([&] {
+    redirect_svr.stop();
+    t2.join();
+  });
+
+  // Wait until servers are up
+  untrusted_svr.wait_until_ready();
+  redirect_svr.wait_until_ready();
+
+  // Client with proxy + follow_location, verification ON (default)
+  Client cli("host.docker.internal", redirect_port);
+  cli.set_proxy("localhost", 3128);
+  cli.set_proxy_basic_auth("hello", "world");
+  cli.set_follow_location(true);
+
+  auto res = cli.Get("/");
+
+  // Self-signed cert must be rejected
+  ASSERT_TRUE(res == nullptr);
+}
+#endif
+
+// ----------------------------------------------------------------------------
+
 template <typename T> void BaseAuthTestFromHTTPWatch(T &cli) {
   cli.set_proxy("localhost", 3128);
   cli.set_proxy_basic_auth("hello", "world");
@@ -153,20 +202,20 @@ template <typename T> void BaseAuthTestFromHTTPWatch(T &cli) {
 }
 
 TEST(BaseAuthTest, NoSSL) {
-  Client cli("httpbin.org");
+  Client cli("httpcan.org");
   BaseAuthTestFromHTTPWatch(cli);
 }
 
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(BaseAuthTest, SSL) {
-  SSLClient cli("httpbin.org");
+  SSLClient cli("httpcan.org");
   BaseAuthTestFromHTTPWatch(cli);
 }
 #endif
 
 // ----------------------------------------------------------------------------
 
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 template <typename T> void DigestAuthTestFromHTTPWatch(T &cli) {
   cli.set_proxy("localhost", 3129);
   cli.set_proxy_digest_auth("hello", "world");
@@ -182,15 +231,17 @@ template <typename T> void DigestAuthTestFromHTTPWatch(T &cli) {
         "/digest-auth/auth/hello/world/MD5",
         "/digest-auth/auth/hello/world/SHA-256",
         "/digest-auth/auth/hello/world/SHA-512",
-        "/digest-auth/auth-int/hello/world/MD5",
     };
 
     cli.set_digest_auth("hello", "world");
     for (auto path : paths) {
       auto res = cli.Get(path.c_str());
       ASSERT_TRUE(res != nullptr);
-      EXPECT_EQ(normalizeJson("{\"authenticated\":true,\"user\":\"hello\"}\n"),
-                normalizeJson(res->body));
+      std::string algo(path.substr(path.rfind('/') + 1));
+      EXPECT_EQ(
+          normalizeJson("{\"algorithm\":\"" + algo +
+                        "\",\"authenticated\":true,\"user\":\"hello\"}\n"),
+          normalizeJson(res->body));
       EXPECT_EQ(StatusCode::OK_200, res->status);
     }
 
@@ -201,24 +252,22 @@ template <typename T> void DigestAuthTestFromHTTPWatch(T &cli) {
       EXPECT_EQ(StatusCode::Unauthorized_401, res->status);
     }
 
-    // NOTE: Until httpbin.org fixes issue #46, the following test is commented
-    // out. Please see https://httpbin.org/digest-auth/auth/hello/world
-    // cli.set_digest_auth("bad", "world");
-    // for (auto path : paths) {
-    //   auto res = cli.Get(path.c_str());
-    //   ASSERT_TRUE(res != nullptr);
-    //   EXPECT_EQ(StatusCode::Unauthorized_401, res->status);
-    // }
+    cli.set_digest_auth("bad", "world");
+    for (auto path : paths) {
+      auto res = cli.Get(path.c_str());
+      ASSERT_TRUE(res != nullptr);
+      EXPECT_EQ(StatusCode::Unauthorized_401, res->status);
+    }
   }
 }
 
 TEST(DigestAuthTest, SSL) {
-  SSLClient cli("httpbin.org");
+  SSLClient cli("httpcan.org");
   DigestAuthTestFromHTTPWatch(cli);
 }
 
 TEST(DigestAuthTest, NoSSL) {
-  Client cli("httpbin.org");
+  Client cli("httpcan.org");
   DigestAuthTestFromHTTPWatch(cli);
 }
 #endif
@@ -230,13 +279,13 @@ template <typename T> void KeepAliveTest(T &cli, bool basic) {
   if (basic) {
     cli.set_proxy_basic_auth("hello", "world");
   } else {
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
     cli.set_proxy_digest_auth("hello", "world");
 #endif
   }
 
   cli.set_follow_location(true);
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
   cli.set_digest_auth("hello", "world");
 #endif
 
@@ -274,7 +323,7 @@ template <typename T> void KeepAliveTest(T &cli, bool basic) {
   }
 }
 
-#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+#ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(KeepAliveTest, NoSSLWithBasic) {
   Client cli("nghttp2.org");
   KeepAliveTest(cli, true);
@@ -295,3 +344,25 @@ TEST(KeepAliveTest, SSLWithDigest) {
   KeepAliveTest(cli, false);
 }
 #endif
+
+// ----------------------------------------------------------------------------
+
+#ifdef CPPHTTPLIB_SSL_ENABLED
+TEST(ProxyTest, SSLOpenStream) {
+  SSLClient cli("nghttp2.org");
+  cli.set_proxy("localhost", 3128);
+  cli.set_proxy_basic_auth("hello", "world");
+
+  auto handle = cli.open_stream("GET", "/httpbin/get");
+  ASSERT_TRUE(handle.response);
+  EXPECT_EQ(StatusCode::OK_200, handle.response->status);
+
+  std::string body;
+  char buf[8192];
+  ssize_t n;
+  while ((n = handle.read(buf, sizeof(buf))) > 0) {
+    body.append(buf, static_cast<size_t>(n));
+  }
+  EXPECT_FALSE(body.empty());
+}
+#endif

test/test_thread_pool.cc

@@ -0,0 +1,228 @@
+// ThreadPool unit tests
+// Set a short idle timeout for faster shrink tests
+#define CPPHTTPLIB_THREAD_POOL_IDLE_TIMEOUT 1
+
+#include <httplib.h>
+
+#include <gtest/gtest.h>
+
+#include <atomic>
+#include <chrono>
+#include <thread>
+#include <vector>
+
+using namespace httplib;
+
+TEST(ThreadPoolTest, BasicTaskExecution) {
+  ThreadPool pool(4);
+  std::atomic<int> count(0);
+
+  for (int i = 0; i < 10; i++) {
+    pool.enqueue([&count]() { count++; });
+  }
+
+  pool.shutdown();
+  EXPECT_EQ(10, count.load());
+}
+
+TEST(ThreadPoolTest, FixedPoolWhenMaxEqualsBase) {
+  // max_n == 0 means max = base (fixed pool behavior)
+  ThreadPool pool(4);
+  std::atomic<int> count(0);
+
+  for (int i = 0; i < 100; i++) {
+    pool.enqueue([&count]() { count++; });
+  }
+
+  pool.shutdown();
+  EXPECT_EQ(100, count.load());
+}
+
+TEST(ThreadPoolTest, DynamicScaleUp) {
+  // base=2, max=8: block 2 base threads, then enqueue more tasks
+  ThreadPool pool(2, 8);
+
+  std::atomic<int> active(0);
+  std::atomic<int> max_active(0);
+  std::atomic<int> completed(0);
+  std::mutex barrier_mutex;
+  std::condition_variable barrier_cv;
+  bool release = false;
+
+  // Occupy all base threads with blocking tasks
+  for (int i = 0; i < 2; i++) {
+    pool.enqueue([&]() {
+      active++;
+      {
+        std::unique_lock<std::mutex> lock(barrier_mutex);
+        barrier_cv.wait(lock, [&] { return release; });
+      }
+      active--;
+      completed++;
+    });
+  }
+
+  // Wait for base threads to be occupied
+  std::this_thread::sleep_for(std::chrono::milliseconds(100));
+
+  // These should trigger dynamic thread creation
+  for (int i = 0; i < 4; i++) {
+    pool.enqueue([&]() {
+      int cur = ++active;
+      // Track peak active count
+      int prev = max_active.load();
+      while (cur > prev && !max_active.compare_exchange_weak(prev, cur)) {}
+      std::this_thread::sleep_for(std::chrono::milliseconds(50));
+      active--;
+      completed++;
+    });
+  }
+
+  // Wait for dynamic tasks to complete
+  std::this_thread::sleep_for(std::chrono::milliseconds(500));
+
+  // Release the blocking tasks
+  {
+    std::unique_lock<std::mutex> lock(barrier_mutex);
+    release = true;
+  }
+  barrier_cv.notify_all();
+
+  pool.shutdown();
+  EXPECT_EQ(6, completed.load());
+  // More than 2 threads were active simultaneously
+  EXPECT_GT(max_active.load(), 2);
+}
+
+TEST(ThreadPoolTest, DynamicShrinkAfterIdle) {
+  // CPPHTTPLIB_THREAD_POOL_IDLE_TIMEOUT is set to 1 second
+  ThreadPool pool(2, 8);
+
+  std::atomic<int> completed(0);
+
+  // Enqueue tasks that require dynamic threads
+  for (int i = 0; i < 8; i++) {
+    pool.enqueue([&]() {
+      std::this_thread::sleep_for(std::chrono::milliseconds(100));
+      completed++;
+    });
+  }
+
+  // Wait for all tasks to complete + idle timeout + margin
+  std::this_thread::sleep_for(std::chrono::milliseconds(2500));
+
+  // Now enqueue a simple task to verify the pool still works
+  // (base threads are still alive)
+  std::atomic<bool> final_task_done(false);
+  pool.enqueue([&]() { final_task_done = true; });
+
+  std::this_thread::sleep_for(std::chrono::milliseconds(100));
+
+  pool.shutdown();
+  EXPECT_EQ(8, completed.load());
+  EXPECT_TRUE(final_task_done.load());
+}
+
+TEST(ThreadPoolTest, ShutdownWithActiveDynamicThreads) {
+  ThreadPool pool(2, 8);
+
+  std::atomic<int> started(0);
+
+  std::mutex block_mutex;
+  std::condition_variable block_cv;
+  bool release = false;
+
+  // Start tasks on dynamic threads that block until released
+  for (int i = 0; i < 6; i++) {
+    pool.enqueue([&]() {
+      started++;
+      std::unique_lock<std::mutex> lock(block_mutex);
+      block_cv.wait(lock, [&] { return release; });
+    });
+  }
+
+  // Wait for tasks to start
+  std::this_thread::sleep_for(std::chrono::milliseconds(200));
+  EXPECT_GE(started.load(), 2);
+
+  // Release all blocked threads, then shutdown
+  {
+    std::unique_lock<std::mutex> lock(block_mutex);
+    release = true;
+  }
+  block_cv.notify_all();
+
+  pool.shutdown();
+}
+
+TEST(ThreadPoolTest, MaxQueuedRequests) {
+  // base=2, max=2 (fixed), mqr=3
+  ThreadPool pool(2, 2, 3);
+
+  std::mutex block_mutex;
+  std::condition_variable block_cv;
+  bool release = false;
+
+  // Block both threads
+  for (int i = 0; i < 2; i++) {
+    EXPECT_TRUE(pool.enqueue([&]() {
+      std::unique_lock<std::mutex> lock(block_mutex);
+      block_cv.wait(lock, [&] { return release; });
+    }));
+  }
+
+  std::this_thread::sleep_for(std::chrono::milliseconds(100));
+
+  // Fill the queue up to max_queued_requests
+  EXPECT_TRUE(pool.enqueue([]() {}));
+  EXPECT_TRUE(pool.enqueue([]() {}));
+  EXPECT_TRUE(pool.enqueue([]() {}));
+
+  // This should fail - queue is full
+  EXPECT_FALSE(pool.enqueue([]() {}));
+
+  // Release blocked threads
+  {
+    std::unique_lock<std::mutex> lock(block_mutex);
+    release = true;
+  }
+  block_cv.notify_all();
+
+  pool.shutdown();
+}
+
+#ifndef CPPHTTPLIB_NO_EXCEPTIONS
+TEST(ThreadPoolTest, InvalidMaxThreadsThrows) {
+  // max_n < n should throw
+  EXPECT_THROW(ThreadPool(8, 4), std::invalid_argument);
+}
+#endif
+
+TEST(ThreadPoolTest, EnqueueAfterShutdownReturnsFalse) {
+  ThreadPool pool(2);
+  pool.shutdown();
+  EXPECT_FALSE(pool.enqueue([]() {}));
+}
+
+TEST(ThreadPoolTest, ConcurrentEnqueue) {
+  ThreadPool pool(4, 16);
+  std::atomic<int> count(0);
+  const int num_producers = 4;
+  const int tasks_per_producer = 100;
+
+  std::vector<std::thread> producers;
+  for (int p = 0; p < num_producers; p++) {
+    producers.emplace_back([&]() {
+      for (int i = 0; i < tasks_per_producer; i++) {
+        pool.enqueue([&count]() { count++; });
+      }
+    });
+  }
+
+  for (auto &t : producers) {
+    t.join();
+  }
+
+  pool.shutdown();
+  EXPECT_EQ(num_producers * tasks_per_producer, count.load());
+}

test/test_websocket_heartbeat.cc

@@ -0,0 +1,156 @@
+// Standalone test for WebSocket automatic heartbeat.
+// Compiled with a 1-second ping interval so we can verify heartbeat behavior
+// without waiting 30 seconds.
+
+#define CPPHTTPLIB_WEBSOCKET_PING_INTERVAL_SECOND 1
+#define CPPHTTPLIB_WEBSOCKET_READ_TIMEOUT_SECOND 3
+#include <httplib.h>
+
+#include "gtest/gtest.h"
+
+using namespace httplib;
+
+class WebSocketHeartbeatTest : public ::testing::Test {
+protected:
+  void SetUp() override {
+    svr_.WebSocket("/ws", [](const Request &, ws::WebSocket &ws) {
+      std::string msg;
+      while (ws.read(msg)) {
+        ws.send(msg);
+      }
+    });
+
+    port_ = svr_.bind_to_any_port("localhost");
+    thread_ = std::thread([this]() { svr_.listen_after_bind(); });
+    svr_.wait_until_ready();
+  }
+
+  void TearDown() override {
+    svr_.stop();
+    thread_.join();
+  }
+
+  Server svr_;
+  int port_;
+  std::thread thread_;
+};
+
+// Verify that an idle connection stays alive beyond the read timeout
+// thanks to automatic heartbeat pings.
+TEST_F(WebSocketHeartbeatTest, IdleConnectionStaysAlive) {
+  ws::WebSocketClient client("ws://localhost:" + std::to_string(port_) + "/ws");
+  ASSERT_TRUE(client.connect());
+
+  // Sleep longer than read timeout (3s). Without heartbeat, the connection
+  // would time out. With heartbeat pings every 1s, it stays alive.
+  std::this_thread::sleep_for(std::chrono::seconds(5));
+
+  // Connection should still be open
+  ASSERT_TRUE(client.is_open());
+
+  // Verify we can still exchange messages
+  ASSERT_TRUE(client.send("hello after idle"));
+  std::string msg;
+  ASSERT_TRUE(client.read(msg));
+  EXPECT_EQ("hello after idle", msg);
+
+  client.close();
+}
+
+// Verify that set_websocket_ping_interval overrides the compile-time default
+TEST_F(WebSocketHeartbeatTest, RuntimePingIntervalOverride) {
+  // The server is already using the compile-time default (1s).
+  // Create a client with a custom runtime interval.
+  ws::WebSocketClient client("ws://localhost:" + std::to_string(port_) + "/ws");
+  client.set_websocket_ping_interval(2);
+  ASSERT_TRUE(client.connect());
+
+  // Sleep longer than read timeout (3s). Client heartbeat at 2s keeps alive.
+  std::this_thread::sleep_for(std::chrono::seconds(5));
+
+  ASSERT_TRUE(client.is_open());
+  ASSERT_TRUE(client.send("runtime interval"));
+  std::string msg;
+  ASSERT_TRUE(client.read(msg));
+  EXPECT_EQ("runtime interval", msg);
+
+  client.close();
+}
+
+// Verify that ping_interval=0 disables heartbeat without breaking basic I/O.
+TEST_F(WebSocketHeartbeatTest, ZeroDisablesHeartbeat) {
+  ws::WebSocketClient client("ws://localhost:" + std::to_string(port_) + "/ws");
+  client.set_websocket_ping_interval(0);
+  ASSERT_TRUE(client.connect());
+
+  // Basic send/receive still works with heartbeat disabled
+  ASSERT_TRUE(client.send("no client ping"));
+  std::string msg;
+  ASSERT_TRUE(client.read(msg));
+  EXPECT_EQ("no client ping", msg);
+
+  client.close();
+}
+
+// Verify that Server::set_websocket_ping_interval works at runtime
+class WebSocketServerPingIntervalTest : public ::testing::Test {
+protected:
+  void SetUp() override {
+    svr_.set_websocket_ping_interval(2);
+    svr_.WebSocket("/ws", [](const Request &, ws::WebSocket &ws) {
+      std::string msg;
+      while (ws.read(msg)) {
+        ws.send(msg);
+      }
+    });
+
+    port_ = svr_.bind_to_any_port("localhost");
+    thread_ = std::thread([this]() { svr_.listen_after_bind(); });
+    svr_.wait_until_ready();
+  }
+
+  void TearDown() override {
+    svr_.stop();
+    thread_.join();
+  }
+
+  Server svr_;
+  int port_;
+  std::thread thread_;
+};
+
+TEST_F(WebSocketServerPingIntervalTest, ServerRuntimeInterval) {
+  ws::WebSocketClient client("ws://localhost:" + std::to_string(port_) + "/ws");
+  ASSERT_TRUE(client.connect());
+
+  // Server ping interval is 2s; client uses compile-time default (1s).
+  // Both keep the connection alive.
+  std::this_thread::sleep_for(std::chrono::seconds(5));
+
+  ASSERT_TRUE(client.is_open());
+  ASSERT_TRUE(client.send("server interval"));
+  std::string msg;
+  ASSERT_TRUE(client.read(msg));
+  EXPECT_EQ("server interval", msg);
+
+  client.close();
+}
+
+// Verify that multiple heartbeat cycles work
+TEST_F(WebSocketHeartbeatTest, MultipleHeartbeatCycles) {
+  ws::WebSocketClient client("ws://localhost:" + std::to_string(port_) + "/ws");
+  ASSERT_TRUE(client.connect());
+
+  // Wait through several heartbeat cycles
+  for (int i = 0; i < 3; i++) {
+    std::this_thread::sleep_for(std::chrono::milliseconds(1500));
+    ASSERT_TRUE(client.is_open());
+    std::string text = "msg" + std::to_string(i);
+    ASSERT_TRUE(client.send(text));
+    std::string msg;
+    ASSERT_TRUE(client.read(msg));
+    EXPECT_EQ(text, msg);
+  }
+
+  client.close();
+}