Release v0.37.2

* Remove 32-bit limitation

* Fix build problems

* Add 32-bit disclaimer and fix MSVC x86 warnings

- Move 32-bit warning to top of README with strong disclaimer
- Add static_cast<size_t> to fix truncation warnings on 32-bit MSVC

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/docs.yml

@@ -0,0 +1,33 @@
+name: docs
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'docs-src/**'
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - name: Install docs-gen
+        run: cargo install docs-gen
+      - name: Build
+        run: docs-gen build docs-src docs
+      - uses: actions/configure-pages@v5
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/tag-latest.yml

@@ -1,19 +0,0 @@
-name: Update latest tag
-
-on:
-  release:
-    types: [published]
-
-jobs:
-  tag-latest:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Force-update latest tag
-        run: |
-          git tag -f latest
-          git push origin latest --force

.github/workflows/test-32bit.yml

@@ -0,0 +1,36 @@
+name: 32-bit Build Test
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  test-win32:
+    name: Windows 32-bit (MSVC x86)
+    runs-on: windows-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build (Win32)
+        shell: cmd
+        run: |
+          call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x86
+          cl /std:c++14 /EHsc /W4 /WX /c /Fo:NUL test\test_32bit_build.cpp
+
+  test-arm32:
+    name: ARM 32-bit (cross-compile)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install cross compiler
+        run: sudo apt-get update && sudo apt-get install -y g++-arm-linux-gnueabihf
+      - name: Build (ARM 32-bit)
+        run: arm-linux-gnueabihf-g++ -std=c++11 -Wall -Wextra -Wno-psabi -Werror -c -o /dev/null test/test_32bit_build.cpp

.github/workflows/test.yaml

@@ -40,7 +40,7 @@ jobs:
           clang-format --version
           cd test && make style_check
 
-  build-error-check-on-32bit:
+  build-and-test-on-32bit:
     runs-on: ubuntu-latest
     if: >
       (github.event_name == 'push') ||
@@ -64,9 +64,8 @@ jobs:
             libssl-dev${{ matrix.config.arch_suffix }} libcurl4-openssl-dev${{ matrix.config.arch_suffix }} \
             zlib1g-dev${{ matrix.config.arch_suffix }} libbrotli-dev${{ matrix.config.arch_suffix }} \
             libzstd-dev${{ matrix.config.arch_suffix }}
-      - name: build and run tests (expect failure)
+      - name: build and run tests
         run: cd test && make test EXTRA_CXXFLAGS="${{ matrix.config.arch_flags }}"
-        continue-on-error: true
 
   ubuntu:
     runs-on: ubuntu-latest

.github/workflows/test_proxy.yaml

@@ -28,6 +28,10 @@ jobs:
     - name: Run proxy tests (OpenSSL)
       if: matrix.tls_backend == 'openssl'
       run: cd test && make proxy
+      env:
+        COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml
     - name: Run proxy tests (Mbed TLS)
       if: matrix.tls_backend == 'mbedtls'
-      run: cd test && make proxy_mbedtls
+      run: cd test && make proxy_mbedtls
+      env:
+        COMPOSE_FILE: docker-compose.yml:docker-compose.ci.yml

.gitignore

@@ -57,6 +57,7 @@ test/*.log
 test/_build_*
 work/
 benchmark/server*
+docs-gen/target/
 
 *.swp
 

CMakeLists.txt

@@ -2,15 +2,19 @@
 	Build options:
 	* Standard BUILD_SHARED_LIBS is supported and sets HTTPLIB_SHARED default value.
 	* HTTPLIB_USE_OPENSSL_IF_AVAILABLE (default on)
+	* HTTPLIB_USE_WOLFSSL_IF_AVAILABLE (default off)
+	* HTTPLIB_USE_MBEDTLS_IF_AVAILABLE (default off)
 	* HTTPLIB_USE_ZLIB_IF_AVAILABLE (default on)
 	* HTTPLIB_USE_BROTLI_IF_AVAILABLE (default on)
 	* HTTPLIB_USE_ZSTD_IF_AVAILABLE (default on)
 	* HTTPLIB_BUILD_MODULES (default off)
 	* HTTPLIB_REQUIRE_OPENSSL (default off)
+	* HTTPLIB_REQUIRE_WOLFSSL (default off)
+	* HTTPLIB_REQUIRE_MBEDTLS (default off)
 	* HTTPLIB_REQUIRE_ZLIB (default off)
 	* HTTPLIB_REQUIRE_BROTLI (default off)
 	* HTTPLIB_REQUIRE_ZSTD (default off)
-	* HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN (default on)
+	* HTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES (default off)
 	* HTTPLIB_USE_NON_BLOCKING_GETADDRINFO (default on)
 	* HTTPLIB_COMPILE (default off)
 	* HTTPLIB_INSTALL (default on)
@@ -21,7 +25,7 @@
 
 	-------------------------------------------------------------------------------
 
-	After installation with Cmake, a find_package(httplib COMPONENTS OpenSSL ZLIB Brotli zstd) is available.
+	After installation with Cmake, a find_package(httplib COMPONENTS OpenSSL wolfssl MbedTLS ZLIB Brotli zstd) is available.
 	This creates a httplib::httplib target (if found and if listed components are supported).
 	It can be linked like so:
 
@@ -48,10 +52,12 @@
 	These variables are available after you run find_package(httplib)
 	* HTTPLIB_HEADER_PATH - this is the full path to the installed header (e.g. /usr/include/httplib.h).
 	* HTTPLIB_IS_USING_OPENSSL - a bool for if OpenSSL support is enabled.
+	* HTTPLIB_IS_USING_WOLFSSL - a bool for if wolfSSL support is enabled.
+	* HTTPLIB_IS_USING_MBEDTLS - a bool for if MbedTLS support is enabled.
 	* HTTPLIB_IS_USING_ZLIB - a bool for if ZLIB support is enabled.
 	* HTTPLIB_IS_USING_BROTLI - a bool for if Brotli support is enabled.
 	* HTTPLIB_IS_USING_ZSTD - a bool for if ZSTD support is enabled.
-	* HTTPLIB_IS_USING_CERTS_FROM_MACOSX_KEYCHAIN - a bool for if support of loading system certs from the Apple Keychain is enabled.
+	* HTTPLIB_IS_USING_MACOSX_AUTOMATIC_ROOT_CERTIFICATES - a bool for if support of loading system certs from the Apple Keychain is enabled.
 	* HTTPLIB_IS_USING_NON_BLOCKING_GETADDRINFO - a bool for if nonblocking getaddrinfo is enabled.
 	* HTTPLIB_IS_COMPILED - a bool for if the library is compiled, or otherwise header-only.
 	* HTTPLIB_INCLUDE_DIR - the root path to httplib's header (e.g. /usr/include).
@@ -95,10 +101,14 @@ set(_HTTPLIB_OPENSSL_MIN_VER "3.0.0")
 option(HTTPLIB_NO_EXCEPTIONS "Disable the use of C++ exceptions" OFF)
 # Allow for a build to require OpenSSL to pass, instead of just being optional
 option(HTTPLIB_REQUIRE_OPENSSL "Requires OpenSSL to be found & linked, or fails build." OFF)
+option(HTTPLIB_REQUIRE_WOLFSSL "Requires wolfSSL to be found & linked, or fails build." OFF)
+option(HTTPLIB_REQUIRE_MBEDTLS "Requires MbedTLS to be found & linked, or fails build." OFF)
 option(HTTPLIB_REQUIRE_ZLIB "Requires ZLIB to be found & linked, or fails build." OFF)
 # Allow for a build to casually enable OpenSSL/ZLIB support, but silently continue if not found.
 # Make these options so their automatic use can be specifically disabled (as needed)
 option(HTTPLIB_USE_OPENSSL_IF_AVAILABLE "Uses OpenSSL (if available) to enable HTTPS support." ON)
+option(HTTPLIB_USE_WOLFSSL_IF_AVAILABLE "Uses wolfSSL (if available) to enable HTTPS support." OFF)
+option(HTTPLIB_USE_MBEDTLS_IF_AVAILABLE "Uses MbedTLS (if available) to enable HTTPS support." OFF)
 option(HTTPLIB_USE_ZLIB_IF_AVAILABLE "Uses ZLIB (if available) to enable Zlib compression support." ON)
 # Lets you compile the program as a regular library instead of header-only
 option(HTTPLIB_COMPILE "If ON, uses a Python script to split the header into a compilable header & source file (requires Python v3)." OFF)
@@ -107,7 +117,7 @@ option(HTTPLIB_INSTALL "Enables the installation target" ON)
 option(HTTPLIB_TEST "Enables testing and builds tests" OFF)
 option(HTTPLIB_REQUIRE_BROTLI "Requires Brotli to be found & linked, or fails build." OFF)
 option(HTTPLIB_USE_BROTLI_IF_AVAILABLE "Uses Brotli (if available) to enable Brotli decompression support." ON)
-option(HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN "Enable feature to load system certs from the Apple Keychain." ON)
+option(HTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES "Disable loading system certs from the Apple Keychain on macOS." OFF)
 option(HTTPLIB_USE_NON_BLOCKING_GETADDRINFO "Enables the non-blocking alternatives for getaddrinfo." ON)
 option(HTTPLIB_REQUIRE_ZSTD "Requires ZSTD to be found & linked, or fails build." OFF)
 option(HTTPLIB_USE_ZSTD_IF_AVAILABLE "Uses ZSTD (if available) to enable zstd support." ON)
@@ -120,6 +130,23 @@ else()
 		message(WARNING "HTTPLIB_BUILD_MODULES requires CMake 3.28 or later. Current version is ${CMAKE_VERSION}. Modules support has been disabled.")
 	endif()
 endif()
+
+# Incompatibility between TLS libraries
+set(TLS_LIBRARIES_USED_TMP 0)
+
+foreach(tls_library OPENSSL WOLFSSL MBEDTLS)
+	set(TLS_REQUIRED ${HTTPLIB_REQUIRE_${tls_library}})
+	set(TLS_IF_AVAILABLE ${HTTPLIB_USE_${tls_library}_IF_AVAILABLE})
+
+	if(TLS_REQUIRED OR TLS_IF_AVAILABLE)
+		math(EXPR TLS_LIBRARIES_USED_TMP "${TLS_LIBRARIES_USED_TMP} + 1")
+	endif()
+endforeach()
+
+if(TLS_LIBRARIES_USED_TMP GREATER 1)
+	message(FATAL_ERROR "TLS libraries are mutually exclusive.")
+endif()
+
 # Defaults to static library but respects standard BUILD_SHARED_LIBS if set
 include(CMakeDependentOption)
 cmake_dependent_option(HTTPLIB_SHARED "Build the library as a shared library instead of static. Has no effect if using header-only."
@@ -139,20 +166,20 @@ endif()
 if(CMAKE_SYSTEM_NAME MATCHES "Windows")
 	if(CMAKE_SYSTEM_VERSION)
 		if(${CMAKE_SYSTEM_VERSION} VERSION_LESS "10.0.0")
-			message(SEND_ERROR "Windows ${CMAKE_SYSTEM_VERSION} or lower is not supported. Please use Windows 10 or later.")
+			message(WARNING "Windows ${CMAKE_SYSTEM_VERSION} or lower is not supported. Please use Windows 10 or later.")
 		endif()
 	else()
 		set(CMAKE_SYSTEM_VERSION "10.0.19041.0")
 		message(WARNING "The target is Windows but CMAKE_SYSTEM_VERSION is not set, the default system version is set to Windows 10.")
 	endif()
 endif()
-if(CMAKE_SIZEOF_VOID_P LESS 8)
-	message(WARNING "Pointer size ${CMAKE_SIZEOF_VOID_P} is not supported. Please use a 64-bit compiler.")
-endif()
 
 # Set some variables that are used in-tree and while building based on our options
 set(HTTPLIB_IS_COMPILED ${HTTPLIB_COMPILE})
-set(HTTPLIB_IS_USING_CERTS_FROM_MACOSX_KEYCHAIN ${HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN})
+set(HTTPLIB_IS_USING_MACOSX_AUTOMATIC_ROOT_CERTIFICATES TRUE)
+if(HTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES)
+	set(HTTPLIB_IS_USING_MACOSX_AUTOMATIC_ROOT_CERTIFICATES FALSE)
+endif()
 set(HTTPLIB_IS_USING_NON_BLOCKING_GETADDRINFO ${HTTPLIB_USE_NON_BLOCKING_GETADDRINFO})
 
 # Threads needed for <thread> on some systems, and for <pthread.h> on Linux
@@ -173,6 +200,22 @@ elseif(HTTPLIB_USE_OPENSSL_IF_AVAILABLE)
 	endif()
 endif()
 
+if(HTTPLIB_REQUIRE_WOLFSSL)
+	find_package(wolfssl REQUIRED)
+	set(HTTPLIB_IS_USING_WOLFSSL TRUE)
+elseif(HTTPLIB_USE_WOLFSSL_IF_AVAILABLE)
+	find_package(wolfssl QUIET)
+	set(HTTPLIB_IS_USING_WOLFSSL ${wolfssl_FOUND})
+endif()
+
+if(HTTPLIB_REQUIRE_MBEDTLS)
+	find_package(MbedTLS REQUIRED)
+	set(HTTPLIB_IS_USING_MBEDTLS TRUE)
+elseif(HTTPLIB_USE_MBEDTLS_IF_AVAILABLE)
+	find_package(MbedTLS QUIET)
+	set(HTTPLIB_IS_USING_MBEDTLS ${MbedTLS_FOUND})
+endif()
+
 if(HTTPLIB_REQUIRE_ZLIB)
 	find_package(ZLIB REQUIRED)
 	set(HTTPLIB_IS_USING_ZLIB TRUE)
@@ -316,7 +359,7 @@ target_link_libraries(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC}
 		$<$<PLATFORM_ID:Windows>:ws2_32>
 		$<$<PLATFORM_ID:Windows>:crypt32>
 		# Needed for API from MacOS Security framework
-		"$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>,$<BOOL:${HTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN}>>:-framework CFNetwork -framework CoreFoundation -framework Security>"
+		"$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>,$<BOOL:${HTTPLIB_IS_USING_MACOSX_AUTOMATIC_ROOT_CERTIFICATES}>>:-framework CFNetwork -framework CoreFoundation -framework Security>"
 		# Needed for non-blocking getaddrinfo on MacOS
 		"$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_USE_NON_BLOCKING_GETADDRINFO}>>:-framework CFNetwork -framework CoreFoundation>"
 		# Can't put multiple targets in a single generator expression or it bugs out.
@@ -327,6 +370,8 @@ target_link_libraries(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC}
 		$<$<BOOL:${HTTPLIB_IS_USING_ZSTD}>:zstd::libzstd>
 		$<$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>:OpenSSL::SSL>
 		$<$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>:OpenSSL::Crypto>
+		$<$<BOOL:${HTTPLIB_IS_USING_WOLFSSL}>:wolfssl::wolfssl>
+		$<$<BOOL:${HTTPLIB_IS_USING_MBEDTLS}>:MbedTLS::mbedtls>
 )
 
 # Set the definitions to enable optional features
@@ -336,7 +381,9 @@ target_compile_definitions(${PROJECT_NAME} ${_INTERFACE_OR_PUBLIC}
 	$<$<BOOL:${HTTPLIB_IS_USING_ZLIB}>:CPPHTTPLIB_ZLIB_SUPPORT>
 	$<$<BOOL:${HTTPLIB_IS_USING_ZSTD}>:CPPHTTPLIB_ZSTD_SUPPORT>
 	$<$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>:CPPHTTPLIB_OPENSSL_SUPPORT>
-	$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_IS_USING_OPENSSL}>,$<BOOL:${HTTPLIB_IS_USING_CERTS_FROM_MACOSX_KEYCHAIN}>>:CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN>
+	$<$<BOOL:${HTTPLIB_IS_USING_WOLFSSL}>:CPPHTTPLIB_WOLFSSL_SUPPORT>
+	$<$<BOOL:${HTTPLIB_IS_USING_MBEDTLS}>:CPPHTTPLIB_MBEDTLS_SUPPORT>
+	$<$<AND:$<PLATFORM_ID:Darwin>,$<BOOL:${HTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES}>>:CPPHTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES>
 	$<$<BOOL:${HTTPLIB_USE_NON_BLOCKING_GETADDRINFO}>:CPPHTTPLIB_USE_NON_BLOCKING_GETADDRINFO>
 )
 

README.md

@@ -2,13 +2,17 @@
 
 [![](https://github.com/yhirose/cpp-httplib/workflows/test/badge.svg)](https://github.com/yhirose/cpp-httplib/actions)
 
-A C++11 single-file header-only cross platform HTTP/HTTPS library.
+A C++11 single-file header-only cross platform HTTP/HTTPS library.<br>
+It's extremely easy to set up. Just include the **[httplib.h](https://raw.githubusercontent.com/yhirose/cpp-httplib/refs/heads/master/httplib.h)** file in your code!
 
-It's extremely easy to set up. Just include the **httplib.h** file in your code!
+Learn more in the [official documentation](https://yhirose.github.io/cpp-httplib/) (built with [docs-gen](https://github.com/yhirose/docs-gen)).
 
 > [!IMPORTANT]
 > This library uses 'blocking' socket I/O. If you are looking for a library with 'non-blocking' socket I/O, this is not the one that you want.
 
+> [!WARNING]
+> 32-bit platforms are **NOT supported**. Use at your own risk. The library may compile on 32-bit targets, but no security review has been conducted for 32-bit environments. Integer truncation and other 32-bit-specific issues may exist. **Security reports that only affect 32-bit platforms will be closed without action.** The maintainer does not have access to 32-bit environments for testing or fixing issues. CI includes basic compile checks only, not functional or security testing.
+
 ## Main Features
 
 - HTTP Server/Client
@@ -79,7 +83,7 @@ cpp-httplib supports multiple TLS backends through an abstraction layer:
 > **Mbed TLS / wolfSSL limitation:** `get_ca_certs()` and `get_ca_names()` only reflect CA certificates loaded via `load_ca_cert_store()` or `load_ca_cert_store(pem, size)`. Certificates loaded through `set_ca_cert_path()` or system certificates (`load_system_certs`) are not enumerable with these backends.
 
 > [!TIP]
-> For macOS: cpp-httplib can use system certs with `CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN`. `CoreFoundation` and `Security` should be linked with `-framework`.
+> For macOS: cpp-httplib automatically loads system certs from the Keychain when a TLS backend is enabled. `CoreFoundation` and `Security` must be linked with `-framework`. To disable this, define `CPPHTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES`.
 
 ```c++
 // Use either OpenSSL, Mbed TLS, or wolfSSL
@@ -536,8 +540,17 @@ svr.Post("/multipart", [&](const Request& req, Response& res) {
       std::cout << "Header: " << header.first << " = " << header.second << std::endl;
     }
 
+    // IMPORTANT: file.filename is an untrusted value from the client.
+    // Always extract only the basename to prevent path traversal attacks.
+    auto safe_name = std::filesystem::path(file.filename).filename();
+    if (safe_name.empty() || safe_name == "." || safe_name == "..") {
+      res.status = StatusCode::BadRequest_400;
+      res.set_content("Invalid filename", "text/plain");
+      return;
+    }
+
     // Save to disk
-    std::ofstream ofs(file.filename, std::ios::binary);
+    std::ofstream ofs(upload_dir / safe_name, std::ios::binary);
     ofs << file.content;
   }
 

cmake/httplibConfig.cmake.in

@@ -4,6 +4,8 @@
 # Setting these here so they're accessible after install.
 # Might be useful for some users to check which settings were used.
 set(HTTPLIB_IS_USING_OPENSSL @HTTPLIB_IS_USING_OPENSSL@)
+set(HTTPLIB_IS_USING_WOLFSSL @HTTPLIB_IS_USING_WOLFSSL@)
+set(HTTPLIB_IS_USING_MBEDTLS @HTTPLIB_IS_USING_MBEDTLS@)
 set(HTTPLIB_IS_USING_ZLIB @HTTPLIB_IS_USING_ZLIB@)
 set(HTTPLIB_IS_COMPILED @HTTPLIB_COMPILE@)
 set(HTTPLIB_IS_USING_BROTLI @HTTPLIB_IS_USING_BROTLI@)
@@ -25,11 +27,22 @@ if(@HTTPLIB_IS_USING_OPENSSL@)
 	endif()
 	set(httplib_OpenSSL_FOUND ${OpenSSL_FOUND})
 endif()
+
 if(@HTTPLIB_IS_USING_ZLIB@)
 	find_dependency(ZLIB)
 	set(httplib_ZLIB_FOUND ${ZLIB_FOUND})
 endif()
 
+if(@HTTPLIB_IS_USING_WOLFSSL@)
+	find_dependency(wolfssl)
+	set(httplib_wolfssl_FOUND ${wolfssl_FOUND})
+endif()
+
+if(@HTTPLIB_IS_USING_MBEDTLS@)
+	find_dependency(MbedTLS)
+	set(httplib_MbedTLS_FOUND ${MbedTLS_FOUND})
+endif()
+
 if(@HTTPLIB_IS_USING_BROTLI@)
 	# Needed so we can use our own FindBrotli.cmake in this file.
 	# Note that the FindBrotli.cmake file is installed in the same dir as this file.

docs-src/config.toml

@@ -0,0 +1,30 @@
+[system]
+theme = "monotone"
+langs = ["en", "ja"]
+
+[site]
+title = "cpp-httplib"
+version = "0.37.2"
+hostname = "https://yhirose.github.io"
+base_path = "/cpp-httplib"
+footer_message = "© 2026 Yuji Hirose. All rights reserved."
+
+[[nav]]
+label = "Tour"
+path = "tour/"
+icon_svg = '<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="10"/><polygon points="16.24 7.76 14.12 14.12 7.76 16.24 9.88 9.88 16.24 7.76"/></svg>'
+
+[[nav]]
+label = "Cookbook"
+path = "cookbook/"
+icon_svg = '<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 19.5A2.5 2.5 0 0 1 6.5 17H20"/><path d="M6.5 2H20v20H6.5A2.5 2.5 0 0 1 4 19.5v-15A2.5 2.5 0 0 1 6.5 2z"/></svg>'
+
+[[nav]]
+label = "LLM App"
+path = "llm-app/"
+icon_svg = '<svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M4 19.5A2.5 2.5 0 0 1 6.5 17H20"/><path d="M6.5 2H20v20H6.5A2.5 2.5 0 0 1 4 19.5v-15A2.5 2.5 0 0 1 6.5 2z"/></svg>'
+
+[[nav]]
+label = "GitHub"
+url = "https://github.com/yhirose/cpp-httplib"
+icon_svg = '<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M9 19c-5 1.5-5-2.5-7-3m14 6v-3.87a3.37 3.37 0 0 0-.94-2.61c3.14-.35 6.44-1.54 6.44-7A5.44 5.44 0 0 0 20 4.77 5.07 5.07 0 0 0 19.91 1S18.73.65 16 2.48a13.38 13.38 0 0 0-7 0C6.27.65 5.09 1 5.09 1A5.07 5.07 0 0 0 5 4.77a5.44 5.44 0 0 0-1.5 3.78c0 5.42 3.3 6.61 6.44 7A3.37 3.37 0 0 0 9 18.13V22"/></svg>'

docs-src/pages/en/cookbook/index.md

@@ -0,0 +1,95 @@
+---
+title: "Cookbook"
+order: 0
+---
+
+A collection of recipes that answer "How do I...?" questions. Each recipe is self-contained — read only what you need.
+
+## Client
+
+### Basics
+- Get the response body as a string / save to a file
+- Send and receive JSON
+- Set default headers (`set_default_headers`)
+- Follow redirects (`set_follow_location`)
+
+### Authentication
+- Use Basic authentication (`set_basic_auth`)
+- Call an API with a Bearer token
+
+### File Upload
+- Upload a file as multipart form data (`make_file_provider`)
+- POST a file as raw binary (`make_file_body`)
+- Send the body with chunked transfer (Content Provider)
+
+### Streaming & Progress
+- Receive a response as a stream
+- Use the progress callback (`set_progress`)
+
+### Connection & Performance
+- Set timeouts (`set_connection_timeout` / `set_read_timeout`)
+- Set an overall timeout (`set_max_timeout`)
+- Understand connection reuse and Keep-Alive behavior
+- Enable compression (`set_compress` / `set_decompress`)
+- Send requests through a proxy (`set_proxy`)
+
+### Error Handling & Debugging
+- Handle error codes (`Result::error()`)
+- Handle SSL errors (`ssl_error()` / `ssl_backend_error()`)
+- Set up client logging (`set_logger` / `set_error_logger`)
+
+## Server
+
+### Basics
+- Register GET / POST / PUT / DELETE handlers
+- Receive JSON requests and return JSON responses
+- Use path parameters (`/users/:id`)
+- Set up a static file server (`set_mount_point`)
+
+### Streaming & Files
+- Stream a large file in the response (`ContentProvider`)
+- Return a file download response (`Content-Disposition`)
+- Receive multipart data as a stream (`ContentReader`)
+- Compress responses (gzip)
+
+### Handler Chain
+- Add pre-processing to all routes (Pre-routing handler)
+- Add response headers with a Post-routing handler (CORS, etc.)
+- Authenticate per route with a Pre-request handler (`matched_route`)
+- Pass data between handlers with `res.user_data`
+
+### Error Handling & Debugging
+- Return custom error pages (`set_error_handler`)
+- Catch exceptions (`set_exception_handler`)
+- Log requests (Logger)
+- Detect client disconnection (`req.is_connection_closed()`)
+
+### Operations & Tuning
+- Assign a port dynamically (`bind_to_any_port`)
+- Control startup order with `listen_after_bind`
+- Shut down gracefully (`stop()` and signal handling)
+- Tune Keep-Alive (`set_keep_alive_max_count` / `set_keep_alive_timeout`)
+- Configure the thread pool (`new_task_queue`)
+
+## TLS / Security
+
+- Choosing between OpenSSL, mbedTLS, and wolfSSL (build-time `#define` differences)
+- Control SSL certificate verification (disable, custom CA, custom callback)
+- Use a custom certificate verification callback (`set_server_certificate_verifier`)
+- Set up an SSL/TLS server (certificate and private key)
+- Configure mTLS (mutual TLS with client certificates)
+- Access the peer certificate on the server (`req.peer_cert()` / SNI)
+
+## SSE
+
+- Implement an SSE server
+- Use event names to distinguish event types
+- Handle reconnection (`Last-Event-ID`)
+- Receive SSE events on the client
+
+## WebSocket
+
+- Implement a WebSocket echo server and client
+- Configure heartbeats (`set_websocket_ping_interval`)
+- Handle connection close
+- Send and receive binary frames

docs-src/pages/en/index.md

@@ -0,0 +1,22 @@
+---
+title: "cpp-httplib"
+order: 0
+---
+
+[cpp-httplib](https://github.com/yhirose/cpp-httplib) is an HTTP/HTTPS library for C++. Just copy a single header file, [`httplib.h`](https://github.com/yhirose/cpp-httplib/raw/refs/tags/latest/httplib.h), and you're ready to go.
+
+When you need a quick HTTP server or client in C++, you want something that just works. That's exactly why I built cpp-httplib. You can start writing both servers and clients in just a few lines of code.
+
+The API uses a lambda-based design that feels natural. It runs anywhere you have a C++11 or later compiler. Windows, macOS, Linux — use whatever environment you already have.
+
+HTTPS works too. Just link OpenSSL or mbedTLS, and both server and client gain TLS support. Content-Encoding (gzip, Brotli, etc.), file uploads, and other features you actually need in real-world development are all included. WebSocket is also supported.
+
+Under the hood, it uses blocking I/O with a thread pool. It's not built for handling massive numbers of simultaneous connections. But for API servers, embedded HTTP in tools, mock servers for testing, and many other use cases, it delivers solid performance.
+
+"Solve today's problem, today." That's the kind of simplicity cpp-httplib aims for.
+
+## Documentation
+
+- [A Tour of cpp-httplib](tour/) — A step-by-step tutorial covering the basics. Start here if you're new
+- [Cookbook](cookbook/) — A collection of recipes organized by topic. Jump to whatever you need
+- [Building a Desktop LLM App](llm-app/) — A hands-on guide to building a desktop app with llama.cpp, step by step

docs-src/pages/en/llm-app/index.md

@@ -0,0 +1,22 @@
+---
+title: "Building a Desktop LLM App with cpp-httplib"
+order: 0
+---
+
+Build an LLM-powered translation desktop app step by step, learning both the server and client sides of cpp-httplib along the way. Translation is just an example — swap it out to build your own summarizer, code generator, chatbot, or any other LLM application.
+
+## Dependencies
+
+- [llama.cpp](https://github.com/ggml-org/llama.cpp) — LLM inference engine
+- [nlohmann/json](https://github.com/nlohmann/json) — JSON parser (header-only)
+- [webview/webview](https://github.com/webview/webview) — WebView wrapper (header-only)
+- [cpp-httplib](https://github.com/yhirose/cpp-httplib) — HTTP server/client (header-only)
+
+## Chapters
+
+1. **Embed llama.cpp and create a REST API** — Start with a simple API that accepts text via POST and returns a translation as JSON
+2. **Add token streaming with SSE** — Stream translation results token by token using the standard LLM API approach
+3. **Add model discovery and download** — Use the client to search and download GGUF models from Hugging Face
+4. **Add a Web UI** — Serve a translation UI with static file hosting, making the app accessible from a browser
+5. **Turn it into a desktop app with WebView** — Wrap the web app with webview/webview to create an Electron-like desktop application
+6. **Code reading: llama.cpp's server implementation** — Compare your implementation with production-quality code and learn from the differences

docs-src/pages/en/tour/01-getting-started.md

@@ -0,0 +1,88 @@
+---
+title: "Getting Started"
+order: 1
+---
+
+All you need to get started with cpp-httplib is `httplib.h` and a C++ compiler. Let's download the file and get a Hello World server running.
+
+## Getting httplib.h
+
+You can download it directly from GitHub. Always use the latest version.
+
+```sh
+curl -LO https://github.com/yhirose/cpp-httplib/raw/refs/tags/latest/httplib.h
+```
+
+Place the downloaded `httplib.h` in your project directory and you're good to go.
+
+## Setting Up Your Compiler
+
+| OS | Development Environment | Setup |
+| -- | ----------------------- | ----- |
+| macOS | Apple Clang | Xcode Command Line Tools (`xcode-select --install`) |
+| Ubuntu | clang++ or g++ | `apt install clang` or `apt install g++` |
+| Windows | MSVC | Visual Studio 2022 or later (install with C++ components) |
+
+## Hello World Server
+
+Save the following code as `server.cpp`.
+
+```cpp
+#include "httplib.h"
+
+int main() {
+    httplib::Server svr;
+
+    svr.Get("/", [](const httplib::Request&, httplib::Response& res) {
+        res.set_content("Hello, World!", "text/plain");
+    });
+
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+In just a few lines, you have a server that responds to HTTP requests.
+
+## Compiling and Running
+
+The sample code in this tutorial is written in C++17 for cleaner, more concise code. cpp-httplib itself can compile with C++11 as well.
+
+```sh
+# macOS
+clang++ -std=c++17 -o server server.cpp
+
+# Linux
+# `-pthread`: cpp-httplib uses threads internally
+clang++ -std=c++17 -pthread -o server server.cpp
+
+# Windows (Developer Command Prompt)
+# `/EHsc`: Enable C++ exception handling
+cl /EHsc /std:c++17 server.cpp
+```
+
+Once it compiles, run it.
+
+```sh
+# macOS / Linux
+./server
+
+# Windows
+server.exe
+```
+
+Open `http://localhost:8080` in your browser. If you see "Hello, World!", you're all set.
+
+You can also verify with `curl`.
+
+```sh
+curl http://localhost:8080/
+# Hello, World!
+```
+
+To stop the server, press `Ctrl+C` in your terminal.
+
+## Next Steps
+
+Now you know the basics of running a server. Next, let's look at the client side. cpp-httplib also comes with HTTP client functionality.
+
+**Next:** [Basic Client](../02-basic-client)

docs-src/pages/en/tour/02-basic-client.md

@@ -0,0 +1,266 @@
+---
+title: "Basic Client"
+order: 2
+---
+
+cpp-httplib isn't just for servers -- it also comes with a full HTTP client. Let's use `httplib::Client` to send GET and POST requests.
+
+## Preparing a Test Server
+
+To try out the client, you need a server that accepts requests. Save the following code, then compile and run it the same way you did in the previous chapter. We'll cover the server details in the next chapter.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.Get("/hi", [](const auto &, auto &res) {
+        res.set_content("Hello!", "text/plain");
+    });
+
+    svr.Get("/search", [](const auto &req, auto &res) {
+        auto q = req.get_param_value("q");
+        res.set_content("Query: " + q, "text/plain");
+    });
+
+    svr.Post("/post", [](const auto &req, auto &res) {
+        res.set_content(req.body, "text/plain");
+    });
+
+    svr.Post("/submit", [](const auto &req, auto &res) {
+        std::string result;
+        for (auto &[key, val] : req.params) {
+            result += key + " = " + val + "\n";
+        }
+        res.set_content(result, "text/plain");
+    });
+
+    svr.Post("/upload", [](const auto &req, auto &res) {
+        auto f = req.form.get_file("file");
+        auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+        res.set_content(content, "text/plain");
+    });
+
+    svr.Get("/users/:id", [](const auto &req, auto &res) {
+        auto id = req.path_params.at("id");
+        res.set_content("User ID: " + id, "text/plain");
+    });
+
+    svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+        auto id = req.matches[1];
+        res.set_content("File ID: " + std::string(id), "text/plain");
+    });
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+## GET Request
+
+Once the server is running, open a separate terminal and give it a try. Let's start with the simplest GET request.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://localhost:8080");
+
+    auto res = cli.Get("/hi");
+    if (res) {
+        std::cout << res->status << std::endl;  // 200
+        std::cout << res->body << std::endl;    // Hello!
+    }
+}
+```
+
+Pass the server address to the `httplib::Client` constructor, then call `Get()` to send a request. You can retrieve the status code and body from the returned `res`.
+
+Here's the equivalent `curl` command.
+
+```sh
+curl http://localhost:8080/hi
+# Hello!
+```
+
+## Checking the Response
+
+A response contains header information in addition to the status code and body.
+
+```cpp
+auto res = cli.Get("/hi");
+if (res) {
+    // Status code
+    std::cout << res->status << std::endl;  // 200
+
+    // Body
+    std::cout << res->body << std::endl;  // Hello!
+
+    // Headers
+    std::cout << res->get_header_value("Content-Type") << std::endl;  // text/plain
+}
+```
+
+`res->body` is a `std::string`, so if you want to parse a JSON response, you can pass it directly to a JSON library like [nlohmann/json](https://github.com/nlohmann/json).
+
+## Query Parameters
+
+To add query parameters to a GET request, you can either write them directly in the URL or use `httplib::Params`.
+
+```cpp
+auto res = cli.Get("/search", httplib::Params{{"q", "cpp-httplib"}});
+if (res) {
+    std::cout << res->body << std::endl;  // Query: cpp-httplib
+}
+```
+
+`httplib::Params` automatically URL-encodes special characters for you.
+
+```sh
+curl "http://localhost:8080/search?q=cpp-httplib"
+# Query: cpp-httplib
+```
+
+## Path Parameters
+
+When values are embedded directly in the URL path, no special client API is needed. Just pass the path to `Get()` as-is.
+
+```cpp
+auto res = cli.Get("/users/42");
+if (res) {
+    std::cout << res->body << std::endl;  // User ID: 42
+}
+```
+
+```sh
+curl http://localhost:8080/users/42
+# User ID: 42
+```
+
+The test server also has a `/files/(\d+)` route that uses a regex to accept numeric IDs only.
+
+```cpp
+auto res = cli.Get("/files/42");
+if (res) {
+    std::cout << res->body << std::endl;  // File ID: 42
+}
+```
+
+```sh
+curl http://localhost:8080/files/42
+# File ID: 42
+```
+
+Pass a non-numeric ID like `/files/abc` and you'll get a 404. We'll cover how that works in the next chapter.
+
+## Request Headers
+
+To add custom HTTP headers, pass an `httplib::Headers` object. This works with both `Get()` and `Post()`.
+
+```cpp
+auto res = cli.Get("/hi", httplib::Headers{
+    {"Authorization", "Bearer my-token"}
+});
+```
+
+```sh
+curl -H "Authorization: Bearer my-token" http://localhost:8080/hi
+```
+
+## POST Request
+
+Let's POST some text data. Pass the body as the second argument to `Post()` and the Content-Type as the third.
+
+```cpp
+auto res = cli.Post("/post", "Hello, Server!", "text/plain");
+if (res) {
+    std::cout << res->status << std::endl;  // 200
+    std::cout << res->body << std::endl;    // Hello, Server!
+}
+```
+
+The test server's `/post` endpoint echoes the body back, so you get the same string you sent.
+
+```sh
+curl -X POST -H "Content-Type: text/plain" -d "Hello, Server!" http://localhost:8080/post
+# Hello, Server!
+```
+
+## Sending Form Data
+
+You can send key-value pairs just like an HTML form. Use `httplib::Params` for this.
+
+```cpp
+auto res = cli.Post("/submit", httplib::Params{
+    {"name", "Alice"},
+    {"age", "30"}
+});
+if (res) {
+    std::cout << res->body << std::endl;
+    // age = 30
+    // name = Alice
+}
+```
+
+This sends the data in `application/x-www-form-urlencoded` format.
+
+```sh
+curl -X POST -d "name=Alice&age=30" http://localhost:8080/submit
+```
+
+## POSTing a File
+
+To upload a file, use `httplib::UploadFormDataItems` to send it as multipart form data.
+
+```cpp
+auto res = cli.Post("/upload", httplib::UploadFormDataItems{
+    {"file", "Hello, File!", "hello.txt", "text/plain"}
+});
+if (res) {
+    std::cout << res->body << std::endl;  // hello.txt (12 bytes)
+}
+```
+
+Each element in `UploadFormDataItems` has four fields: `{name, content, filename, content_type}`.
+
+```sh
+curl -F "file=Hello, File!;filename=hello.txt;type=text/plain" http://localhost:8080/upload
+```
+
+## Error Handling
+
+Network communication can fail -- the server might not be reachable. Always check whether `res` is valid.
+
+```cpp
+httplib::Client cli("http://localhost:9999");  // Non-existent port
+auto res = cli.Get("/hi");
+
+if (!res) {
+    // Connection error
+    std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    // Error: Connection
+    return 1;
+}
+
+// If we reach here, we have a response
+if (res->status != 200) {
+    std::cout << "HTTP Error: " << res->status << std::endl;
+    return 1;
+}
+
+std::cout << res->body << std::endl;
+```
+
+There are two levels of errors.
+
+- **Connection error**: The client couldn't reach the server. `res` evaluates to false, and you can call `res.error()` to find out what went wrong.
+- **HTTP error**: The server returned an error status (404, 500, etc.). `res` evaluates to true, but you need to check `res->status`.
+
+## Next Steps
+
+Now you know how to send requests from a client. Next, let's take a closer look at the server side. We'll dig into routing, path parameters, and more.
+
+**Next:** [Basic Server](../03-basic-server)

docs-src/pages/en/tour/03-basic-server.md

@@ -0,0 +1,280 @@
+---
+title: "Basic Server"
+order: 3
+---
+
+In the previous chapter, you sent requests from a client to a test server. Now let's walk through how that server actually works.
+
+## Starting the Server
+
+Once you've registered your routes, call `svr.listen()` to start the server.
+
+```cpp
+svr.listen("0.0.0.0", 8080);
+```
+
+The first argument is the host, and the second is the port. `"0.0.0.0"` listens on all network interfaces. Use `"127.0.0.1"` if you want to accept connections from your own machine only.
+
+`listen()` is a blocking call. It won't return until the server stops. The server keeps running until you press `Ctrl+C` in your terminal or call `svr.stop()` from another thread.
+
+## Routing
+
+Routing is the heart of any server. It's how you tell cpp-httplib: when a request comes in for this URL with this HTTP method, run this code.
+
+```cpp
+httplib::Server svr;
+
+svr.Get("/hi", [](const httplib::Request &req, httplib::Response &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+`svr.Get()` registers a handler for GET requests. The first argument is the path, the second is the handler function. When a GET request arrives at `/hi`, your lambda runs.
+
+There's a method for each HTTP verb.
+
+```cpp
+svr.Get("/path",    handler);  // GET
+svr.Post("/path",   handler);  // POST
+svr.Put("/path",    handler);  // PUT
+svr.Delete("/path", handler);  // DELETE
+```
+
+The handler signature is `(const httplib::Request &req, httplib::Response &res)`. You can use `auto` to keep it short.
+
+```cpp
+svr.Get("/hi", [](const auto &req, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+The handler only runs when the path matches. Requests to unregistered paths automatically return 404.
+
+## The Request Object
+
+The first parameter `req` gives you everything the client sent.
+
+### Body
+
+`req.body` holds the request body as a `std::string`.
+
+```cpp
+svr.Post("/post", [](const auto &req, auto &res) {
+    // Echo the body back to the client
+    res.set_content(req.body, "text/plain");
+});
+```
+
+### Headers
+
+Use `req.get_header_value()` to read a request header.
+
+```cpp
+svr.Get("/check", [](const auto &req, auto &res) {
+    auto auth = req.get_header_value("Authorization");
+    res.set_content("Auth: " + auth, "text/plain");
+});
+```
+
+### Query Parameters and Form Data
+
+`req.get_param_value()` retrieves a parameter by name. It works for both GET query parameters and POST form data.
+
+```cpp
+svr.Get("/search", [](const auto &req, auto &res) {
+    auto q = req.get_param_value("q");
+    res.set_content("Query: " + q, "text/plain");
+});
+```
+
+A request to `/search?q=cpp-httplib` gives you `"cpp-httplib"` for `q`.
+
+To loop over all parameters, use `req.params`.
+
+```cpp
+svr.Post("/submit", [](const auto &req, auto &res) {
+    std::string result;
+    for (auto &[key, val] : req.params) {
+        result += key + " = " + val + "\n";
+    }
+    res.set_content(result, "text/plain");
+});
+```
+
+### File Uploads
+
+Files uploaded via multipart form data are available through `req.form.get_file()`.
+
+```cpp
+svr.Post("/upload", [](const auto &req, auto &res) {
+    auto f = req.form.get_file("file");
+    auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+    res.set_content(content, "text/plain");
+});
+```
+
+`f.filename` gives you the filename, and `f.content` gives you the file data.
+
+## Path Parameters
+
+Sometimes you want to capture part of the URL as a variable -- for example, the `42` in `/users/42`. Use the `:param` syntax to do that.
+
+```cpp
+svr.Get("/users/:id", [](const auto &req, auto &res) {
+    auto id = req.path_params.at("id");
+    res.set_content("User ID: " + id, "text/plain");
+});
+```
+
+A request to `/users/42` gives you `"42"` from `req.path_params.at("id")`. `/users/100` gives you `"100"`.
+
+You can capture multiple segments at once.
+
+```cpp
+svr.Get("/users/:user_id/posts/:post_id", [](const auto &req, auto &res) {
+    auto user_id = req.path_params.at("user_id");
+    auto post_id = req.path_params.at("post_id");
+    res.set_content("User: " + user_id + ", Post: " + post_id, "text/plain");
+});
+```
+
+### Regex Patterns
+
+You can also write a regular expression directly in the path instead of `:param`. Capture group values are available via `req.matches`, which is a `std::smatch`.
+
+```cpp
+// Only accept numeric IDs
+svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+    auto id = req.matches[1];  // First capture group
+    res.set_content("File ID: " + std::string(id), "text/plain");
+});
+```
+
+`/files/42` matches, but `/files/abc` doesn't. This is handy when you want to constrain what values are accepted.
+
+## Building a Response
+
+The second parameter `res` is how you send data back to the client.
+
+### Body and Content-Type
+
+`res.set_content()` sets the body and Content-Type. That's all you need for a 200 response.
+
+```cpp
+svr.Get("/hi", [](const auto &req, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+### Status Code
+
+To return a different status code, assign to `res.status`.
+
+```cpp
+svr.Get("/not-found", [](const auto &req, auto &res) {
+    res.status = 404;
+    res.set_content("Not found", "text/plain");
+});
+```
+
+### Response Headers
+
+Add response headers with `res.set_header()`.
+
+```cpp
+svr.Get("/with-header", [](const auto &req, auto &res) {
+    res.set_header("X-Custom", "my-value");
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+## Walking Through the Test Server
+
+Now let's use what we've learned to read through the test server from the previous chapter.
+
+### GET /hi
+
+```cpp
+svr.Get("/hi", [](const auto &, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+The simplest possible handler. We don't need any information from the request, so the `req` parameter is left unnamed. It just returns `"Hello!"`.
+
+### GET /search
+
+```cpp
+svr.Get("/search", [](const auto &req, auto &res) {
+    auto q = req.get_param_value("q");
+    res.set_content("Query: " + q, "text/plain");
+});
+```
+
+`req.get_param_value("q")` pulls out the query parameter `q`. A request to `/search?q=cpp-httplib` returns `"Query: cpp-httplib"`.
+
+### POST /post
+
+```cpp
+svr.Post("/post", [](const auto &req, auto &res) {
+    res.set_content(req.body, "text/plain");
+});
+```
+
+An echo server. Whatever body the client sends, `req.body` holds it, and we send it straight back.
+
+### POST /submit
+
+```cpp
+svr.Post("/submit", [](const auto &req, auto &res) {
+    std::string result;
+    for (auto &[key, val] : req.params) {
+        result += key + " = " + val + "\n";
+    }
+    res.set_content(result, "text/plain");
+});
+```
+
+Loops over the form data in `req.params` using structured bindings (`auto &[key, val]`) to unpack each key-value pair.
+
+### POST /upload
+
+```cpp
+svr.Post("/upload", [](const auto &req, auto &res) {
+    auto f = req.form.get_file("file");
+    auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+    res.set_content(content, "text/plain");
+});
+```
+
+Receives a file uploaded via multipart form data. `req.form.get_file("file")` fetches the field named `"file"`, and we respond with the filename and size.
+
+### GET /users/:id
+
+```cpp
+svr.Get("/users/:id", [](const auto &req, auto &res) {
+    auto id = req.path_params.at("id");
+    res.set_content("User ID: " + id, "text/plain");
+});
+```
+
+`:id` is the path parameter. `req.path_params.at("id")` retrieves its value. `/users/42` gives you `"42"`, `/users/alice` gives you `"alice"`.
+
+### GET /files/(\d+)
+
+```cpp
+svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+    auto id = req.matches[1];
+    res.set_content("File ID: " + std::string(id), "text/plain");
+});
+```
+
+The regex `(\d+)` matches numeric IDs only. `/files/42` hits this handler, but `/files/abc` returns 404. `req.matches[1]` retrieves the first capture group.
+
+## Next Steps
+
+You now have the full picture of how a server works. Routing, reading requests, building responses -- that's enough to build a real API server.
+
+Next, let's look at serving static files. We'll build a server that delivers HTML and CSS.
+
+**Next:** [Static File Server](../04-static-file-server)

docs-src/pages/en/tour/04-static-file-server.md

@@ -0,0 +1,134 @@
+---
+title: "Static File Server"
+order: 4
+---
+
+cpp-httplib can serve static files too — HTML, CSS, images, you name it. No complicated configuration required. One call to `set_mount_point()` is all it takes.
+
+## The basics of set_mount_point
+
+Let's jump right in. `set_mount_point()` maps a URL path to a local directory.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.set_mount_point("/", "./html");
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+The first argument is the URL mount point. The second is the local directory path. In this example, requests to `/` are served from the `./html` directory.
+
+Let's try it out. First, create an `html` directory and add an `index.html` file.
+
+```sh
+mkdir html
+```
+
+```html
+<!DOCTYPE html>
+<html>
+<head><title>My Page</title></head>
+<body>
+    <h1>Hello from cpp-httplib!</h1>
+    <p>This is a static file.</p>
+</body>
+</html>
+```
+
+Compile and start the server.
+
+```sh
+g++ -std=c++17 -o server server.cpp -pthread
+./server
+```
+
+Open `http://localhost:8080` in your browser. You should see the contents of `html/index.html`. Visiting `http://localhost:8080/index.html` returns the same page.
+
+You can also access it with the client code from the previous chapter, or with `curl`.
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+auto res = cli.Get("/");
+if (res) {
+    std::cout << res->body << std::endl;  // HTML is displayed
+}
+```
+
+```sh
+curl http://localhost:8080
+```
+
+## Multiple mount points
+
+You can call `set_mount_point()` as many times as you like. Each URL path gets its own directory.
+
+```cpp
+svr.set_mount_point("/", "./public");
+svr.set_mount_point("/assets", "./static/assets");
+svr.set_mount_point("/docs", "./documentation");
+```
+
+A request to `/assets/style.css` serves `./static/assets/style.css`. A request to `/docs/guide.html` serves `./documentation/guide.html`.
+
+## Combining with handlers
+
+Static file serving and routing handlers — the kind you learned about in the previous chapter — work side by side.
+
+```cpp
+httplib::Server svr;
+
+// API endpoint
+svr.Get("/api/hello", [](const auto &, auto &res) {
+    res.set_content(R"({"message":"Hello!"})", "application/json");
+});
+
+// Static file serving
+svr.set_mount_point("/", "./public");
+
+svr.listen("0.0.0.0", 8080);
+```
+
+Handlers take priority. The handler responds to `/api/hello`. For every other path, the server looks for a file in `./public`.
+
+## Adding response headers
+
+Pass headers as the third argument to `set_mount_point()` and they get attached to every static file response. This is great for cache control.
+
+```cpp
+svr.set_mount_point("/", "./public", {
+    {"Cache-Control", "max-age=3600"}
+});
+```
+
+With this in place, the browser caches served files for one hour.
+
+## A Dockerfile for your static file server
+
+The cpp-httplib repository includes a `Dockerfile` built for static file serving. We also publish a pre-built image on Docker Hub, so you can get up and running with a single command.
+
+```sh
+> docker run -p 8080:80 -v ./my-site:/html yhirose4dockerhub/cpp-httplib-server
+Serving HTTP on 0.0.0.0:80
+Mount point: / -> ./html
+Press Ctrl+C to shutdown gracefully...
+192.168.65.1 - - [22/Feb/2026:12:00:00 +0000] "GET / HTTP/1.1" 200 256 "-" "Mozilla/5.0 ..."
+192.168.65.1 - - [22/Feb/2026:12:00:00 +0000] "GET /style.css HTTP/1.1" 200 1024 "-" "Mozilla/5.0 ..."
+192.168.65.1 - - [22/Feb/2026:12:00:01 +0000] "GET /favicon.ico HTTP/1.1" 404 152 "-" "Mozilla/5.0 ..."
+```
+
+Everything in your `./my-site` directory gets served on port 8080. The access log follows the same format as NGINX, so you can see exactly what's happening.
+
+## What's next
+
+You can now serve static files. A web server that delivers HTML, CSS, and JavaScript — built with this little code.
+
+Next, let's encrypt your connections with HTTPS. We'll start by setting up a TLS library.
+
+**Next:** [TLS Setup](../05-tls-setup)

docs-src/pages/en/tour/05-tls-setup.md

@@ -0,0 +1,88 @@
+---
+title: "TLS Setup"
+order: 5
+---
+
+So far we've been using plain HTTP, but in the real world, HTTPS is the norm. To use HTTPS with cpp-httplib, you need a TLS library.
+
+In this tour, we'll use OpenSSL. It's the most widely used option, and you'll find plenty of resources online.
+
+## Installing OpenSSL
+
+Install it for your OS.
+
+| OS | How to install |
+| -- | -------------- |
+| macOS | [Homebrew](https://brew.sh/) (`brew install openssl`) |
+| Ubuntu / Debian | `sudo apt install libssl-dev` |
+| Windows | [vcpkg](https://vcpkg.io/) (`vcpkg install openssl`) |
+
+## Compile Options
+
+To enable TLS, define the `CPPHTTPLIB_OPENSSL_SUPPORT` macro when compiling. You'll need a few extra options compared to the previous chapters.
+
+```sh
+# macOS (Homebrew)
+clang++ -std=c++17 -DCPPHTTPLIB_OPENSSL_SUPPORT \
+    -I$(brew --prefix openssl)/include \
+    -L$(brew --prefix openssl)/lib \
+    -lssl -lcrypto \
+    -framework CoreFoundation -framework Security \
+    -o server server.cpp
+
+# Linux
+clang++ -std=c++17 -pthread -DCPPHTTPLIB_OPENSSL_SUPPORT \
+    -lssl -lcrypto \
+    -o server server.cpp
+
+# Windows (Developer Command Prompt)
+cl /EHsc /std:c++17 /DCPPHTTPLIB_OPENSSL_SUPPORT server.cpp libssl.lib libcrypto.lib
+```
+
+Let's look at what each option does.
+
+- **`-DCPPHTTPLIB_OPENSSL_SUPPORT`** — Defines the macro that enables TLS support
+- **`-lssl -lcrypto`** — Links the OpenSSL libraries
+- **`-I` / `-L`** (macOS only) — Points to the Homebrew OpenSSL paths
+- **`-framework CoreFoundation -framework Security`** (macOS only) — Needed to automatically load system certificates from the Keychain
+
+## Verifying the Setup
+
+Let's make sure everything works. Here's a simple program that passes an HTTPS URL to `httplib::Client`.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://www.google.com");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << "Status: " << res->status << std::endl;
+    } else {
+        std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    }
+}
+```
+
+Compile and run it. If you see `Status: 200`, your setup is complete.
+
+## Other TLS Backends
+
+cpp-httplib also supports Mbed TLS and wolfSSL in addition to OpenSSL. You can switch between them just by changing the macro definition and linked libraries.
+
+| Backend | Macro | Libraries to link |
+| :--- | :--- | :--- |
+| OpenSSL | `CPPHTTPLIB_OPENSSL_SUPPORT` | `libssl`, `libcrypto` |
+| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` |
+| wolfSSL | `CPPHTTPLIB_WOLFSSL_SUPPORT` | `libwolfssl` |
+
+This tour assumes OpenSSL, but the API is the same regardless of which backend you choose.
+
+## Next Step
+
+You're all set with TLS. Next, let's send a request to an HTTPS site.
+
+**Next:** [HTTPS Client](../06-https-client)

docs-src/pages/en/tour/06-https-client.md

@@ -0,0 +1,122 @@
+---
+title: "HTTPS Client"
+order: 6
+---
+
+In the previous chapter, you set up OpenSSL. Now let's put it to use with an HTTPS client. You can use the same `httplib::Client` from Chapter 2. Just pass a URL with the `https://` scheme to the constructor.
+
+## GET Request
+
+Let's try accessing a real HTTPS site.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://nghttp2.org");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->status << std::endl;           // 200
+        std::cout << res->body.substr(0, 100) << std::endl;  // First 100 chars of the HTML
+    } else {
+        std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    }
+}
+```
+
+In Chapter 2, you wrote `httplib::Client cli("http://localhost:8080")`. All you need to change is the scheme to `https://`. Every API you learned in Chapter 2 -- `Get()`, `Post()`, and so on -- works exactly the same way.
+
+```sh
+curl https://nghttp2.org/
+```
+
+## Specifying a Port
+
+The default port for HTTPS is 443. If you need a different port, include it in the URL.
+
+```cpp
+httplib::Client cli("https://localhost:8443");
+```
+
+## CA Certificate Verification
+
+When connecting over HTTPS, `httplib::Client` verifies the server certificate by default. It only connects to servers whose certificate was issued by a trusted CA (Certificate Authority).
+
+CA certificates are loaded automatically from the Keychain on macOS, the system CA certificate store on Linux, and the Windows certificate store on Windows. In most cases, no extra configuration is needed.
+
+### Specifying a CA Certificate File
+
+On some environments, the system CA certificates may not be found. In that case, use `set_ca_cert_path()` to specify the path directly.
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+cli.set_ca_cert_path("/etc/ssl/certs/ca-certificates.crt");
+
+auto res = cli.Get("/");
+```
+
+```sh
+curl --cacert /etc/ssl/certs/ca-certificates.crt https://nghttp2.org/
+```
+
+### Disabling Certificate Verification
+
+During development, you might want to connect to a server with a self-signed certificate. You can disable verification for that.
+
+```cpp
+httplib::Client cli("https://localhost:8443");
+cli.enable_server_certificate_verification(false);
+
+auto res = cli.Get("/");
+```
+
+```sh
+curl -k https://localhost:8443/
+```
+
+Never disable this in production. It opens you up to man-in-the-middle attacks.
+
+## Following Redirects
+
+When accessing HTTPS sites, you'll often encounter redirects. For example, `http://` to `https://`, or a bare domain to `www`.
+
+By default, redirects are not followed. You can check the redirect target in the `Location` header.
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+
+auto res = cli.Get("/httpbin/redirect/3");
+if (res) {
+    std::cout << res->status << std::endl;  // 302
+    std::cout << res->get_header_value("Location") << std::endl;
+}
+```
+
+```sh
+curl https://nghttp2.org/httpbin/redirect/3
+```
+
+Call `set_follow_location(true)` to automatically follow redirects and get the final response.
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+cli.set_follow_location(true);
+
+auto res = cli.Get("/httpbin/redirect/3");
+if (res) {
+    std::cout << res->status << std::endl;  // 200 (the final response)
+}
+```
+
+```sh
+curl -L https://nghttp2.org/httpbin/redirect/3
+```
+
+## Next Steps
+
+Now you know how to use the HTTPS client. Next, let's set up your own HTTPS server. We'll start with creating a self-signed certificate.
+
+**Next:** [HTTPS Server](../07-https-server)

docs-src/pages/en/tour/07-https-server.md

@@ -0,0 +1,124 @@
+---
+title: "HTTPS Server"
+order: 7
+---
+
+In the previous chapter, you used an HTTPS client. Now let's set up your own HTTPS server. Just swap `httplib::Server` from Chapter 3 with `httplib::SSLServer`.
+
+A TLS server needs a server certificate and a private key, though. Let's get those ready first.
+
+## Creating a Self-Signed Certificate
+
+For development and testing, a self-signed certificate works just fine. You can generate one quickly with an OpenSSL command.
+
+```sh
+openssl req -x509 -noenc -keyout key.pem -out cert.pem -subj /CN=localhost
+```
+
+This creates two files:
+
+- **`cert.pem`** — Server certificate
+- **`key.pem`** — Private key
+
+## A Minimal HTTPS Server
+
+Once you have your certificate, let's write the server.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::SSLServer svr("cert.pem", "key.pem");
+
+    svr.Get("/", [](const auto &, auto &res) {
+        res.set_content("Hello, HTTPS!", "text/plain");
+    });
+
+    std::cout << "Listening on https://localhost:8443" << std::endl;
+    svr.listen("0.0.0.0", 8443);
+}
+```
+
+Just pass the certificate and private key paths to the `httplib::SSLServer` constructor. The routing API is exactly the same as `httplib::Server` from Chapter 3.
+
+Compile and start it up.
+
+## Testing It Out
+
+With the server running, try accessing it with `curl`. Since we're using a self-signed certificate, add the `-k` option to skip certificate verification.
+
+```sh
+curl -k https://localhost:8443/
+# Hello, HTTPS!
+```
+
+If you open `https://localhost:8443` in a browser, you'll see a "This connection is not secure" warning. That's expected with a self-signed certificate. Just proceed past it.
+
+## Connecting from a Client
+
+Let's connect using `httplib::Client` from the previous chapter. There are two ways to connect to a server with a self-signed certificate.
+
+### Option 1: Disable Certificate Verification
+
+This is the quick and easy approach for development.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://localhost:8443");
+    cli.enable_server_certificate_verification(false);
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->body << std::endl;  // Hello, HTTPS!
+    }
+}
+```
+
+### Option 2: Specify the Self-Signed Certificate as a CA Certificate
+
+This is the safer approach. You tell the client to trust `cert.pem` as a CA certificate.
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://localhost:8443");
+    cli.set_ca_cert_path("cert.pem");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->body << std::endl;  // Hello, HTTPS!
+    }
+}
+```
+
+This way, only connections to the server with that specific certificate are allowed, preventing impersonation. Use this approach whenever possible, even in test environments.
+
+## Comparing Server and SSLServer
+
+The `httplib::Server` API you learned in Chapter 3 works exactly the same with `httplib::SSLServer`. The only difference is the constructor.
+
+| | `httplib::Server` | `httplib::SSLServer` |
+| -- | ------------------ | -------------------- |
+| Constructor | No arguments | Certificate and private key paths |
+| Protocol | HTTP | HTTPS |
+| Port (convention) | 8080 | 8443 |
+| Routing | Same | Same |
+
+To switch an HTTP server to HTTPS, just change the constructor.
+
+## Next Steps
+
+Your HTTPS server is up and running. You now have the basics of both HTTP/HTTPS clients and servers covered.
+
+Next, let's look at the WebSocket support that was recently added to cpp-httplib.
+
+**Next:** [WebSocket](../08-websocket)

docs-src/pages/en/tour/08-websocket.md

@@ -0,0 +1,139 @@
+---
+title: "WebSocket"
+order: 8
+---
+
+cpp-httplib supports WebSocket as well. Unlike HTTP request/response, WebSocket lets the server and client exchange messages in both directions. It's great for chat apps and real-time notifications.
+
+Let's build an echo server and client right away.
+
+## Echo Server
+
+Here's an echo server that sends back whatever message it receives.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+        std::string msg;
+        while (ws.read(msg)) {
+            ws.send(msg);  // Send back the received message as-is
+        }
+    });
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+You register a WebSocket handler with `svr.WebSocket()`. It works just like `svr.Get()` and `svr.Post()` from Chapter 3.
+
+Inside the handler, `ws.read(msg)` waits for a message. When the connection closes, `read()` returns `false`, so the loop exits. `ws.send(msg)` sends a message back.
+
+## Connecting from a Client
+
+Let's connect to the server using `httplib::ws::WebSocketClient`.
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::ws::WebSocketClient client("ws://localhost:8080/ws");
+
+    if (!client.connect()) {
+        std::cout << "Connection failed" << std::endl;
+        return 1;
+    }
+
+    // Send a message
+    client.send("Hello, WebSocket!");
+
+    // Receive a response from the server
+    std::string msg;
+    if (client.read(msg)) {
+        std::cout << msg << std::endl;  // Hello, WebSocket!
+    }
+
+    client.close();
+}
+```
+
+Pass a URL in `ws://host:port/path` format to the constructor. Call `connect()` to start the connection, then use `send()` and `read()` to exchange messages.
+
+## Text and Binary
+
+WebSocket has two types of messages: text and binary. You can tell them apart by the return value of `read()`.
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    httplib::ws::ReadResult ret;
+    while ((ret = ws.read(msg))) {
+        if (ret == httplib::ws::Binary) {
+            ws.send(msg.data(), msg.size());  // Send as binary
+        } else {
+            ws.send(msg);  // Send as text
+        }
+    }
+});
+```
+
+- `ws.send(const std::string &)` — sends as a text message
+- `ws.send(const char *, size_t)` — sends as a binary message
+
+The client-side API is the same.
+
+## Accessing Request Information
+
+You can read HTTP request information from the handshake through the first argument `req` in the handler. This is handy for checking authentication tokens.
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    auto token = req.get_header_value("Authorization");
+    if (token.empty()) {
+        ws.close(httplib::ws::CloseStatus::PolicyViolation, "unauthorized");
+        return;
+    }
+
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send(msg);
+    }
+});
+```
+
+## Using WSS
+
+WebSocket over HTTPS (WSS) is also supported. On the server side, just register a WebSocket handler on `httplib::SSLServer`.
+
+```cpp
+httplib::SSLServer svr("cert.pem", "key.pem");
+
+svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send(msg);
+    }
+});
+
+svr.listen("0.0.0.0", 8443);
+```
+
+On the client side, use the `wss://` scheme.
+
+```cpp
+httplib::ws::WebSocketClient client("wss://localhost:8443/ws");
+```
+
+## Next Steps
+
+Now you know the basics of WebSocket. This wraps up the Tour.
+
+The next page gives you a summary of features we didn't cover in the Tour.
+
+**Next:** [What's Next](../09-whats-next)

docs-src/pages/en/tour/09-whats-next.md

@@ -0,0 +1,228 @@
+---
+title: "What's Next"
+order: 9
+---
+
+Great job finishing the Tour! You now have a solid grasp of the cpp-httplib basics. But there's a lot more to explore. Here's a quick overview of features we didn't cover in the Tour, organized by category.
+
+## Streaming API
+
+When you're working with LLM streaming responses or downloading large files, you don't want to load the entire response into memory. Use `stream::Get()` to process data chunk by chunk.
+
+```cpp
+httplib::Client cli("http://localhost:11434");
+
+auto result = httplib::stream::Get(cli, "/api/generate");
+
+if (result) {
+    while (result.next()) {
+        std::cout.write(result.data(), result.size());
+    }
+}
+```
+
+You can also pass a `content_receiver` callback to `Get()`. This approach works with Keep-Alive.
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+
+cli.Get("/stream", [](const char *data, size_t len) {
+    std::cout.write(data, len);
+    return true;
+});
+```
+
+On the server side, you have `set_content_provider()` and `set_chunked_content_provider()`. Use the former when you know the size, and the latter when you don't.
+
+```cpp
+// With known size (sets Content-Length)
+svr.Get("/file", [](const auto &, auto &res) {
+    auto size = get_file_size("large.bin");
+    res.set_content_provider(size, "application/octet-stream",
+        [](size_t offset, size_t length, httplib::DataSink &sink) {
+            // Send 'length' bytes starting from 'offset'
+            return true;
+        });
+});
+
+// Unknown size (Chunked Transfer Encoding)
+svr.Get("/stream", [](const auto &, auto &res) {
+    res.set_chunked_content_provider("text/plain",
+        [](size_t offset, httplib::DataSink &sink) {
+            sink.write("chunk\n", 6);
+            return true;  // Return false to finish
+        });
+});
+```
+
+For uploading large files, `make_file_provider()` comes in handy. It streams the file instead of loading it all into memory.
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+
+auto res = cli.Post("/upload", {}, {
+    httplib::make_file_provider("file", "/path/to/large-file.zip")
+});
+```
+
+## Server-Sent Events (SSE)
+
+We provide an SSE client as well. It supports automatic reconnection and resuming via `Last-Event-ID`.
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << msg.event << ": " << msg.data << std::endl;
+});
+
+sse.start();  // Blocking, with auto-reconnection
+```
+
+You can also set separate handlers for each event type.
+
+```cpp
+sse.on_event("update", [](const httplib::sse::SSEMessage &msg) {
+    // Only handles "update" events
+});
+```
+
+## Authentication
+
+The client has helpers for Basic auth, Bearer Token auth, and Digest auth.
+
+```cpp
+httplib::Client cli("https://api.example.com");
+cli.set_basic_auth("user", "password");
+cli.set_bearer_token_auth("my-token");
+```
+
+## Compression
+
+We support compression and decompression with gzip, Brotli, and Zstandard. Define the corresponding macro when you compile.
+
+| Method | Macro |
+| -- | -- |
+| gzip | `CPPHTTPLIB_ZLIB_SUPPORT` |
+| Brotli | `CPPHTTPLIB_BROTLI_SUPPORT` |
+| Zstandard | `CPPHTTPLIB_ZSTD_SUPPORT` |
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_compress(true);    // Compress request body
+cli.set_decompress(true);  // Decompress response body
+```
+
+## Proxy
+
+You can connect through an HTTP proxy.
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_proxy("proxy.example.com", 8080);
+cli.set_proxy_basic_auth("user", "password");
+```
+
+## Timeouts
+
+You can set connection, read, and write timeouts individually.
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_connection_timeout(5, 0);  // 5 seconds
+cli.set_read_timeout(10, 0);       // 10 seconds
+cli.set_write_timeout(10, 0);      // 10 seconds
+```
+
+## Keep-Alive
+
+If you're making multiple requests to the same server, enable Keep-Alive. It reuses the TCP connection, which is much more efficient.
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_keep_alive(true);
+```
+
+## Server Middleware
+
+You can hook into request processing before and after handlers run.
+
+```cpp
+svr.set_pre_routing_handler([](const auto &req, auto &res) {
+    // Runs before every request
+    return httplib::Server::HandlerResponse::Unhandled;  // Continue to normal routing
+});
+
+svr.set_post_routing_handler([](const auto &req, auto &res) {
+    // Runs after the response is sent
+    res.set_header("X-Server", "cpp-httplib");
+});
+```
+
+Use `req.user_data` to pass data from middleware to handlers. This is useful for sharing things like decoded auth tokens.
+
+```cpp
+svr.set_pre_routing_handler([](const auto &req, auto &res) {
+    req.user_data["auth_user"] = std::string("alice");
+    return httplib::Server::HandlerResponse::Unhandled;
+});
+
+svr.Get("/me", [](const auto &req, auto &res) {
+    auto user = std::any_cast<std::string>(req.user_data.at("auth_user"));
+    res.set_content("Hello, " + user, "text/plain");
+});
+```
+
+You can also customize error and exception handlers.
+
+```cpp
+svr.set_error_handler([](const auto &req, auto &res) {
+    res.set_content("Custom Error Page", "text/html");
+});
+
+svr.set_exception_handler([](const auto &req, auto &res, std::exception_ptr ep) {
+    res.status = 500;
+    res.set_content("Internal Server Error", "text/plain");
+});
+```
+
+## Logging
+
+You can set a logger on both the server and the client.
+
+```cpp
+svr.set_logger([](const auto &req, const auto &res) {
+    std::cout << req.method << " " << req.path << " " << res.status << std::endl;
+});
+```
+
+## Unix Domain Socket
+
+In addition to TCP, we support Unix Domain Sockets. You can use them for inter-process communication on the same machine.
+
+```cpp
+// Server
+httplib::Server svr;
+svr.set_address_family(AF_UNIX);
+svr.listen("/tmp/httplib.sock", 0);
+```
+
+```cpp
+// Client
+httplib::Client cli("http://localhost");
+cli.set_address_family(AF_UNIX);
+cli.set_hostname_addr_map({{"localhost", "/tmp/httplib.sock"}});
+
+auto res = cli.Get("/");
+```
+
+## Learn More
+
+Want to dig deeper? Check out these resources.
+
+- Cookbook — A collection of recipes for common use cases
+- [README](https://github.com/yhirose/cpp-httplib/blob/master/README.md) — Full API reference
+- [README-sse](https://github.com/yhirose/cpp-httplib/blob/master/README-sse.md) — How to use Server-Sent Events
+- [README-stream](https://github.com/yhirose/cpp-httplib/blob/master/README-stream.md) — How to use the Streaming API
+- [README-websocket](https://github.com/yhirose/cpp-httplib/blob/master/README-websocket.md) — How to use the WebSocket server

docs-src/pages/en/tour/index.md

@@ -0,0 +1,16 @@
+---
+title: "A Tour of cpp-httplib"
+order: 0
+---
+
+This is a step-by-step tutorial that walks you through the basics of cpp-httplib. Each chapter builds on the previous one, so please read them in order starting from Chapter 1.
+
+1. [Getting Started](01-getting-started) — Get httplib.h and build a Hello World server
+2. [Basic Client](02-basic-client) — Send GET/POST requests and use path parameters
+3. [Basic Server](03-basic-server) — Routing, path parameters, and building responses
+4. [Static File Server](04-static-file-server) — Serve static files
+5. [TLS Setup](05-tls-setup) — Set up OpenSSL / mbedTLS
+6. [HTTPS Client](06-https-client) — Make requests to HTTPS sites
+7. [HTTPS Server](07-https-server) — Build an HTTPS server
+8. [WebSocket](08-websocket) — Learn the basics of WebSocket communication
+9. [What's Next](09-whats-next) — Explore more features

docs-src/pages/ja/cookbook/index.md

@@ -0,0 +1,95 @@
+---
+title: "Cookbook"
+order: 0
+---
+
+「〇〇をするには？」という問いに答えるレシピ集です。各レシピは独立しているので、必要なページだけ読めます。
+
+## クライアント
+
+### 基本
+- レスポンスボディを文字列で取得する / ファイルに保存する
+- JSON を送受信する
+- デフォルトヘッダーを設定する（`set_default_headers`）
+- リダイレクトを追従する（`set_follow_location`）
+
+### 認証
+- Basic 認証を使う（`set_basic_auth`）
+- Bearer トークンで API を呼ぶ
+
+### ファイル送信
+- ファイルをマルチパートフォームとしてアップロードする（`make_file_provider`）
+- ファイルを生バイナリとして POST する（`make_file_body`）
+- チャンク転送でボディを送る（Content Provider）
+
+### ストリーミング・進捗
+- レスポンスをストリーミングで受信する
+- 進捗コールバックを使う（`set_progress`）
+
+### 接続・パフォーマンス
+- タイムアウトを設定する（`set_connection_timeout` / `set_read_timeout`）
+- 全体タイムアウトを設定する（`set_max_timeout`）
+- 接続の再利用と Keep-Alive の挙動を理解する
+- 圧縮を有効にする（`set_compress` / `set_decompress`）
+- プロキシを経由してリクエストを送る（`set_proxy`）
+
+### エラー処理・デバッグ
+- エラーコードをハンドリングする（`Result::error()`）
+- SSL エラーをハンドリングする（`ssl_error()` / `ssl_backend_error()`）
+- クライアントにログを設定する（`set_logger` / `set_error_logger`）
+
+## サーバー
+
+### 基本
+- GET / POST / PUT / DELETE ハンドラを登録する
+- JSON リクエストを受け取り JSON レスポンスを返す
+- パスパラメーターを使う（`/users/:id`）
+- 静的ファイルサーバーを設定する（`set_mount_point`）
+
+### ストリーミング・ファイル
+- 大きなファイルをストリーミングで返す（`ContentProvider`）
+- ファイルダウンロードレスポンスを返す（`Content-Disposition`）
+- マルチパートデータをストリーミングで受け取る（`ContentReader`）
+- レスポンスを圧縮して返す（gzip）
+
+### ハンドラチェーン
+- 全ルートに共通の前処理をする（Pre-routing handler）
+- Post-routing handler でレスポンスヘッダーを追加する（CORS など）
+- Pre-request handler でルート単位の認証を行う（`matched_route`）
+- `res.user_data` でハンドラ間データを渡す
+
+### エラー処理・デバッグ
+- カスタムエラーページを返す（`set_error_handler`）
+- 例外をキャッチする（`set_exception_handler`）
+- リクエストをログに記録する（Logger）
+- クライアントが切断したか検出する（`req.is_connection_closed()`）
+
+### 運用・チューニング
+- ポートを動的に割り当てる（`bind_to_any_port`）
+- `listen_after_bind` で起動順序を制御する
+- グレースフルシャットダウンする（`stop()` とシグナルハンドリング）
+- Keep-Alive を調整する（`set_keep_alive_max_count` / `set_keep_alive_timeout`）
+- マルチスレッド数を設定する（`new_task_queue`）
+
+## TLS / セキュリティ
+
+- OpenSSL・mbedTLS・wolfSSL の選択指針（ビルド時の `#define` の違い）
+- SSL 証明書の検証を制御する（証明書の無効化・カスタム CA・カスタムコールバック）
+- カスタム証明書検証コールバックを使う（`set_server_certificate_verifier`）
+- SSL/TLS サーバーを立ち上げる（証明書・秘密鍵の設定）
+- mTLS（クライアント証明書による相互認証）を設定する
+- サーバー側でピア証明書を参照する（`req.peer_cert()` / SNI）
+
+## SSE
+
+- SSE サーバーを実装する
+- SSE でイベント名を使い分ける
+- SSE の再接続を処理する（`Last-Event-ID`）
+- SSE をクライアントで受信する
+
+## WebSocket
+
+- WebSocket エコーサーバー／クライアントを実装する
+- ハートビートを設定する（`set_websocket_ping_interval`）
+- 接続クローズをハンドリングする
+- バイナリフレームを送受信する

docs-src/pages/ja/index.md

@@ -0,0 +1,22 @@
+---
+title: "cpp-httplib"
+order: 0
+---
+
+[cpp-httplib](https://github.com/yhirose/cpp-httplib)は、C++用のHTTP/HTTPSライブラリです。[`httplib.h`](https://github.com/yhirose/cpp-httplib/raw/refs/tags/latest/httplib.h) というヘッダーファイルを1枚コピーするだけで使えます。
+
+C++でちょっとしたHTTPサーバーやクライアントが必要になったとき、すぐに動くものが欲しいですよね。cpp-httplibはまさにそのために作られました。サーバーもクライアントも、数行のコードで書き始められます。
+
+APIはラムダ式をベースにした直感的な設計で、C++11以降のコンパイラーがあればどこでも動きます。Windows、macOS、Linux — お使いの環境をそのまま使えます。
+
+HTTPSも使えます。OpenSSLやmbedTLSをリンクするだけで、サーバー・クライアントの両方がTLSに対応します。Content-Encoding（gzip, brotli等）、ファイルアップロードなど、実際の開発で必要になる機能もひと通り揃っています。WebSocketもサポートしています。
+
+内部的にはブロッキングI/Oとスレッドプールを使っています。大量の同時接続を捌くような用途には向きませんが、APIサーバーやツールの組み込みHTTP、テスト用のモックサーバーなど、多くのユースケースで十分な性能を発揮します。
+
+「今日の課題を、今日中に解決する」— cpp-httplibが目指しているのは、そういうシンプルさです。
+
+## ドキュメント
+
+- [A Tour of cpp-httplib](tour/) — 基本を順を追って学べるチュートリアル。初めての方はここから
+- [Cookbook](cookbook/) — 目的別のレシピ集。必要なトピックから読めます
+- [Building a Desktop LLM App](llm-app/) — llama.cpp を組み込んだデスクトップアプリを段階的に構築する実践ガイド

docs-src/pages/ja/llm-app/index.md

@@ -0,0 +1,22 @@
+---
+title: "Building a Desktop LLM App with cpp-httplib"
+order: 0
+---
+
+llama.cpp を組み込んだ LLM 翻訳デスクトップアプリを段階的に構築しながら、cpp-httplib のサーバー・クライアント両面の使い方を実践的に学びます。翻訳は一例であり、この部分を差し替えることで要約・コード生成・チャットボットなど自分のアプリに応用できます。
+
+## 依存ライブラリ
+
+- [llama.cpp](https://github.com/ggml-org/llama.cpp) — LLM 推論エンジン
+- [nlohmann/json](https://github.com/nlohmann/json) — JSON パーサー（ヘッダーオンリー）
+- [webview/webview](https://github.com/webview/webview) — WebView ラッパー（ヘッダーオンリー）
+- [cpp-httplib](https://github.com/yhirose/cpp-httplib) — HTTP サーバー/クライアント（ヘッダーオンリー）
+
+## 章立て
+
+1. **llama.cpp を組み込んで REST API を作る** — テキストを POST すると翻訳結果を JSON で返すシンプルな API から始める
+2. **SSE でトークンストリーミングを追加する** — 翻訳結果をトークン単位で逐次返す LLM API 標準の方式を実装する
+3. **モデルの取得・管理機能を追加する** — Hugging Face から GGUF モデルを検索・ダウンロードするクライアント機能を実装する
+4. **Web UI を追加する** — 静的ファイル配信で翻訳 UI をホストし、ブラウザから操作できるようにする
+5. **WebView でデスクトップアプリ化する** — webview/webview で包み、Electron 的なデスクトップアプリとして動作させる
+6. **llama.cpp 本家のサーバー実装をコードリーディング** — 自分で作ったものとプロダクション品質のコードを比較して学ぶ

docs-src/pages/ja/tour/01-getting-started.md

@@ -0,0 +1,88 @@
+---
+title: "Getting Started"
+order: 1
+---
+
+cpp-httplibを始めるのに必要なのは、`httplib.h`とC++コンパイラーだけです。ファイルをダウンロードして、Hello Worldサーバーを動かすところまでやってみましょう。
+
+## httplib.h の入手
+
+GitHubから直接ダウンロードできます。常に最新版を使ってください。
+
+```sh
+curl -LO https://github.com/yhirose/cpp-httplib/raw/refs/tags/latest/httplib.h
+```
+
+ダウンロードした `httplib.h` をプロジェクトのディレクトリに置けば、準備完了です。
+
+## コンパイラーの準備
+
+| OS | 開発環境 | セットアップ |
+| -- | -------- | ------------ |
+| macOS | Apple Clang | Xcode Command Line Tools (`xcode-select --install`) |
+| Ubuntu | clang++ または g++ | `apt install clang` または `apt install g++` |
+| Windows | MSVC | Visual Studio 2022 以降（C++ コンポーネントを含めてインストール） |
+
+## Hello World サーバー
+
+次のコードを `server.cpp` として保存しましょう。
+
+```cpp
+#include "httplib.h"
+
+int main() {
+    httplib::Server svr;
+
+    svr.Get("/", [](const httplib::Request&, httplib::Response& res) {
+        res.set_content("Hello, World!", "text/plain");
+    });
+
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+たった数行で、HTTPリクエストに応答するサーバーが書けます。
+
+## コンパイルと実行
+
+このチュートリアルのサンプルコードは、コードを簡潔に書けるC++17で書いています。cpp-httplib自体はC++11でもコンパイルできます。
+
+```sh
+# macOS
+clang++ -std=c++17 -o server server.cpp
+
+# Linux
+# `-pthread`: cpp-httplibは内部でスレッドを使用
+clang++ -std=c++17 -pthread -o server server.cpp
+
+# Windows (Developer Command Prompt)
+# `/EHsc`: C++例外処理を有効化
+cl /EHsc /std:c++17 server.cpp
+```
+
+コンパイルできたら実行します。
+
+```sh
+# macOS / Linux
+./server
+
+# Windows
+server.exe
+```
+
+ブラウザで `http://localhost:8080` を開いてください。"Hello, World!" と表示されれば成功です。
+
+`curl` でも確認できます。
+
+```sh
+curl http://localhost:8080/
+# Hello, World!
+```
+
+サーバーを停止するには、ターミナルで `Ctrl+C` を押します。
+
+## 次のステップ
+
+サーバーの基本がわかりましたね。次は、クライアント側を見てみましょう。cpp-httplibはHTTPクライアント機能も備えています。
+
+**次:** [Basic Client](../02-basic-client)

docs-src/pages/ja/tour/02-basic-client.md

@@ -0,0 +1,266 @@
+---
+title: "Basic Client"
+order: 2
+---
+
+cpp-httplibはサーバーだけでなく、HTTPクライアント機能も備えています。`httplib::Client` を使って、GETやPOSTリクエストを送ってみましょう。
+
+## テスト用サーバーの準備
+
+クライアントの動作を確認するために、リクエストを受け付けるサーバーを用意します。次のコードを保存し、前章と同じ手順でコンパイル・実行してください。サーバーの詳しい解説は次章で行います。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.Get("/hi", [](const auto &, auto &res) {
+        res.set_content("Hello!", "text/plain");
+    });
+
+    svr.Get("/search", [](const auto &req, auto &res) {
+        auto q = req.get_param_value("q");
+        res.set_content("Query: " + q, "text/plain");
+    });
+
+    svr.Post("/post", [](const auto &req, auto &res) {
+        res.set_content(req.body, "text/plain");
+    });
+
+    svr.Post("/submit", [](const auto &req, auto &res) {
+        std::string result;
+        for (auto &[key, val] : req.params) {
+            result += key + " = " + val + "\n";
+        }
+        res.set_content(result, "text/plain");
+    });
+
+    svr.Post("/upload", [](const auto &req, auto &res) {
+        auto f = req.form.get_file("file");
+        auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+        res.set_content(content, "text/plain");
+    });
+
+    svr.Get("/users/:id", [](const auto &req, auto &res) {
+        auto id = req.path_params.at("id");
+        res.set_content("User ID: " + id, "text/plain");
+    });
+
+    svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+        auto id = req.matches[1];
+        res.set_content("File ID: " + std::string(id), "text/plain");
+    });
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+## GETリクエスト
+
+サーバーが起動したら、別のターミナルを開いて試してみましょう。まず、最もシンプルなGETリクエストです。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("http://localhost:8080");
+
+    auto res = cli.Get("/hi");
+    if (res) {
+        std::cout << res->status << std::endl;  // 200
+        std::cout << res->body << std::endl;    // Hello!
+    }
+}
+```
+
+`httplib::Client` のコンストラクターにサーバーのアドレスを渡し、`Get()` でリクエストを送ります。戻り値の `res` からステータスコードやボディを取得できます。
+
+対応する `curl` コマンドはこうなります。
+
+```sh
+curl http://localhost:8080/hi
+# Hello!
+```
+
+## レスポンスの確認
+
+レスポンスには、ステータスコードとボディ以外にもヘッダー情報が含まれています。
+
+```cpp
+auto res = cli.Get("/hi");
+if (res) {
+    // ステータスコード
+    std::cout << res->status << std::endl;  // 200
+
+    // ボディ
+    std::cout << res->body << std::endl;  // Hello!
+
+    // ヘッダー
+    std::cout << res->get_header_value("Content-Type") << std::endl;  // text/plain
+}
+```
+
+`res->body` は `std::string` なので、JSON レスポンスをパースしたい場合は [nlohmann/json](https://github.com/nlohmann/json) などの JSON ライブラリにそのまま渡せます。
+
+## クエリパラメーター
+
+GETリクエストにクエリパラメーターを付けるには、URLに直接書くか、`httplib::Params` を使います。
+
+```cpp
+auto res = cli.Get("/search", httplib::Params{{"q", "cpp-httplib"}});
+if (res) {
+    std::cout << res->body << std::endl;  // Query: cpp-httplib
+}
+```
+
+`httplib::Params` を使うと、特殊文字のURLエンコードを自動で行ってくれます。
+
+```sh
+curl "http://localhost:8080/search?q=cpp-httplib"
+# Query: cpp-httplib
+```
+
+## パスパラメーター
+
+URLのパスに値を直接埋め込む場合も、クライアント側は特別なAPIは不要です。パスをそのまま `Get()` に渡すだけです。
+
+```cpp
+auto res = cli.Get("/users/42");
+if (res) {
+    std::cout << res->body << std::endl;  // User ID: 42
+}
+```
+
+```sh
+curl http://localhost:8080/users/42
+# User ID: 42
+```
+
+テスト用サーバーには、正規表現でIDを数字のみに絞った `/files/(\d+)` もあります。
+
+```cpp
+auto res = cli.Get("/files/42");
+if (res) {
+    std::cout << res->body << std::endl;  // File ID: 42
+}
+```
+
+```sh
+curl http://localhost:8080/files/42
+# File ID: 42
+```
+
+`/files/abc` のように数字以外を渡すと404が返ります。仕組みは次章で解説します。
+
+## リクエストヘッダー
+
+カスタムHTTPヘッダーを付けるには、`httplib::Headers` を渡します。`Get()` や `Post()` のどちらでも使えます。
+
+```cpp
+auto res = cli.Get("/hi", httplib::Headers{
+    {"Authorization", "Bearer my-token"}
+});
+```
+
+```sh
+curl -H "Authorization: Bearer my-token" http://localhost:8080/hi
+```
+
+## POSTリクエスト
+
+テキストデータをPOSTしてみましょう。`Post()` の第2引数にボディ、第3引数にContent-Typeを指定します。
+
+```cpp
+auto res = cli.Post("/post", "Hello, Server!", "text/plain");
+if (res) {
+    std::cout << res->status << std::endl;  // 200
+    std::cout << res->body << std::endl;    // Hello, Server!
+}
+```
+
+テスト用サーバーの `/post` はボディをそのまま返すので、送った文字列がそのまま返ってきます。
+
+```sh
+curl -X POST -H "Content-Type: text/plain" -d "Hello, Server!" http://localhost:8080/post
+# Hello, Server!
+```
+
+## フォームデータの送信
+
+HTMLフォームのように、キーと値のペアを送ることもできます。`httplib::Params` を使います。
+
+```cpp
+auto res = cli.Post("/submit", httplib::Params{
+    {"name", "Alice"},
+    {"age", "30"}
+});
+if (res) {
+    std::cout << res->body << std::endl;
+    // age = 30
+    // name = Alice
+}
+```
+
+これは `application/x-www-form-urlencoded` 形式で送信されます。
+
+```sh
+curl -X POST -d "name=Alice&age=30" http://localhost:8080/submit
+```
+
+## ファイルのPOST
+
+ファイルをアップロードするには、`httplib::UploadFormDataItems` を使ってマルチパートフォームデータとして送信します。
+
+```cpp
+auto res = cli.Post("/upload", httplib::UploadFormDataItems{
+    {"file", "Hello, File!", "hello.txt", "text/plain"}
+});
+if (res) {
+    std::cout << res->body << std::endl;  // hello.txt (12 bytes)
+}
+```
+
+`UploadFormDataItems` の各要素は `{name, content, filename, content_type}` の4つのフィールドで構成されます。
+
+```sh
+curl -F "file=Hello, File!;filename=hello.txt;type=text/plain" http://localhost:8080/upload
+```
+
+## エラーハンドリング
+
+ネットワーク通信では、サーバーに接続できない場合があります。`res` が有効かどうかを必ず確認しましょう。
+
+```cpp
+httplib::Client cli("http://localhost:9999");  // 存在しないポート
+auto res = cli.Get("/hi");
+
+if (!res) {
+    // 接続エラー
+    std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    // Error: Connection
+    return 1;
+}
+
+// ここに到達すればレスポンスを受信できている
+if (res->status != 200) {
+    std::cout << "HTTP Error: " << res->status << std::endl;
+    return 1;
+}
+
+std::cout << res->body << std::endl;
+```
+
+エラーには2つのレベルがあります。
+
+- **接続エラー**: サーバーに到達できなかった場合。`res` が偽になり、`res.error()` でエラーの種類を取得できます
+- **HTTPエラー**: サーバーからエラーステータス（404、500など）が返ってきた場合。`res` は真ですが、`res->status` を確認する必要があります
+
+## 次のステップ
+
+クライアントからリクエストを送る方法がわかりました。次は、サーバー側をもっと詳しく見てみましょう。ルーティングやパスパラメータなど、サーバーの機能を掘り下げます。
+
+**次:** [Basic Server](../03-basic-server)

docs-src/pages/ja/tour/03-basic-server.md

@@ -0,0 +1,280 @@
+---
+title: "Basic Server"
+order: 3
+---
+
+前章ではクライアントからリクエストを送りました。そのとき、テスト用サーバーを用意しましたね。この章では、あのサーバーの仕組みをひとつずつ紐解いていきます。
+
+## サーバーの起動
+
+ルーティングを登録したら、最後に `svr.listen()` を呼んでサーバーを起動します。
+
+```cpp
+svr.listen("0.0.0.0", 8080);
+```
+
+第1引数はホスト、第2引数はポート番号です。`"0.0.0.0"` を指定すると、すべてのネットワークインターフェースでリクエストを受け付けます。自分のマシンからのアクセスだけに限定したいときは `"127.0.0.1"` を使います。
+
+`listen()` はブロッキング呼び出しです。サーバーが停止するまで、この行から先には進みません。ターミナルで `Ctrl+C` を押すか、別スレッドから `svr.stop()` を呼ぶまでサーバーは動き続けます。
+
+## ルーティング
+
+サーバーの核になるのは「ルーティング」です。どのURLに、どのHTTPメソッドでアクセスされたら、何をするか。それを登録する仕組みです。
+
+```cpp
+httplib::Server svr;
+
+svr.Get("/hi", [](const httplib::Request &req, httplib::Response &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+`svr.Get()` は、GETリクエストに対するハンドラーを登録します。第1引数がパス、第2引数がハンドラー関数です。`/hi` にGETリクエストが来たら、このラムダが呼ばれます。
+
+HTTPメソッドごとにメソッドが用意されています。
+
+```cpp
+svr.Get("/path",    handler);  // GET
+svr.Post("/path",   handler);  // POST
+svr.Put("/path",    handler);  // PUT
+svr.Delete("/path", handler);  // DELETE
+```
+
+ハンドラーのシグネチャは `(const httplib::Request &req, httplib::Response &res)` です。`auto` を使って短く書くこともできます。
+
+```cpp
+svr.Get("/hi", [](const auto &req, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+パスが一致したときだけハンドラーが呼ばれます。登録されていないパスにアクセスすると、自動的に404が返ります。
+
+## リクエストオブジェクト
+
+ハンドラーの第1引数 `req` から、クライアントが送ってきた情報を読み取れます。
+
+### ボディ
+
+`req.body` でリクエストボディを取得できます。型は `std::string` です。
+
+```cpp
+svr.Post("/post", [](const auto &req, auto &res) {
+    // クライアントが送ったボディをそのまま返す
+    res.set_content(req.body, "text/plain");
+});
+```
+
+### ヘッダー
+
+`req.get_header_value()` でリクエストヘッダーの値を取得できます。
+
+```cpp
+svr.Get("/check", [](const auto &req, auto &res) {
+    auto auth = req.get_header_value("Authorization");
+    res.set_content("Auth: " + auth, "text/plain");
+});
+```
+
+### クエリパラメーターとフォームデータ
+
+`req.get_param_value()` でパラメーターを取得できます。GETのクエリパラメーターと、POSTのフォームデータの両方に使えます。
+
+```cpp
+svr.Get("/search", [](const auto &req, auto &res) {
+    auto q = req.get_param_value("q");
+    res.set_content("Query: " + q, "text/plain");
+});
+```
+
+`/search?q=cpp-httplib` にアクセスすると、`q` の値は `"cpp-httplib"` になります。
+
+すべてのパラメーターをループで処理したいときは、`req.params` を使います。
+
+```cpp
+svr.Post("/submit", [](const auto &req, auto &res) {
+    std::string result;
+    for (auto &[key, val] : req.params) {
+        result += key + " = " + val + "\n";
+    }
+    res.set_content(result, "text/plain");
+});
+```
+
+### ファイルアップロード
+
+マルチパートフォームでアップロードされたファイルは、`req.form.get_file()` で取得します。
+
+```cpp
+svr.Post("/upload", [](const auto &req, auto &res) {
+    auto f = req.form.get_file("file");
+    auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+    res.set_content(content, "text/plain");
+});
+```
+
+`f.filename` でファイル名、`f.content` でファイルの中身にアクセスできます。
+
+## パスパラメーター
+
+URLの一部を変数として受け取りたいことがあります。たとえば `/users/42` の `42` を取得したい場合です。`:param` 記法を使うと、URLの一部をキャプチャできます。
+
+```cpp
+svr.Get("/users/:id", [](const auto &req, auto &res) {
+    auto id = req.path_params.at("id");
+    res.set_content("User ID: " + id, "text/plain");
+});
+```
+
+`/users/42` にアクセスすると、`req.path_params.at("id")` は `"42"` を返します。`/users/100` なら `"100"` です。
+
+複数のパスパラメーターも使えます。
+
+```cpp
+svr.Get("/users/:user_id/posts/:post_id", [](const auto &req, auto &res) {
+    auto user_id = req.path_params.at("user_id");
+    auto post_id = req.path_params.at("post_id");
+    res.set_content("User: " + user_id + ", Post: " + post_id, "text/plain");
+});
+```
+
+### 正規表現パターン
+
+`:param` の代わりに正規表現をパスに書くこともできます。キャプチャグループの値は `req.matches` で取得します。型は `std::smatch` です。
+
+```cpp
+// 数字のみのIDを受け付ける
+svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+    auto id = req.matches[1];  // 最初のキャプチャグループ
+    res.set_content("File ID: " + std::string(id), "text/plain");
+});
+```
+
+`/files/42` にはマッチしますが、`/files/abc` にはマッチしません。入力値を絞り込みたいときに便利です。
+
+## レスポンスの組み立て
+
+ハンドラーの第2引数 `res` を使って、クライアントに返すレスポンスを組み立てます。
+
+### ボディとContent-Type
+
+`res.set_content()` でボディとContent-Typeを設定します。これだけでステータスコード200のレスポンスが返ります。
+
+```cpp
+svr.Get("/hi", [](const auto &req, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+### ステータスコード
+
+ステータスコードを変えたいときは、`res.status` に代入します。
+
+```cpp
+svr.Get("/not-found", [](const auto &req, auto &res) {
+    res.status = 404;
+    res.set_content("Not found", "text/plain");
+});
+```
+
+### レスポンスヘッダー
+
+`res.set_header()` でレスポンスヘッダーを追加できます。
+
+```cpp
+svr.Get("/with-header", [](const auto &req, auto &res) {
+    res.set_header("X-Custom", "my-value");
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+## 前章のサーバーを読み解く
+
+ここまでの知識を使って、前章で用意したテスト用サーバーを改めて見てみましょう。
+
+### GET /hi
+
+```cpp
+svr.Get("/hi", [](const auto &, auto &res) {
+    res.set_content("Hello!", "text/plain");
+});
+```
+
+最もシンプルなハンドラーです。リクエストの情報は使わないので、`req` の変数名を省略しています。`"Hello!"` というテキストをそのまま返します。
+
+### GET /search
+
+```cpp
+svr.Get("/search", [](const auto &req, auto &res) {
+    auto q = req.get_param_value("q");
+    res.set_content("Query: " + q, "text/plain");
+});
+```
+
+`req.get_param_value("q")` でクエリパラメーター `q` の値を取り出します。`/search?q=cpp-httplib` なら、レスポンスは `"Query: cpp-httplib"` になります。
+
+### POST /post
+
+```cpp
+svr.Post("/post", [](const auto &req, auto &res) {
+    res.set_content(req.body, "text/plain");
+});
+```
+
+クライアントが送ったリクエストボディを、そのままレスポンスとして返すエコーサーバーです。`req.body` にボディが丸ごと入っています。
+
+### POST /submit
+
+```cpp
+svr.Post("/submit", [](const auto &req, auto &res) {
+    std::string result;
+    for (auto &[key, val] : req.params) {
+        result += key + " = " + val + "\n";
+    }
+    res.set_content(result, "text/plain");
+});
+```
+
+フォームデータとして送られたキーと値のペアを、`req.params` でループ処理しています。構造化束縛 `auto &[key, val]` を使って、各ペアを取り出しています。
+
+### POST /upload
+
+```cpp
+svr.Post("/upload", [](const auto &req, auto &res) {
+    auto f = req.form.get_file("file");
+    auto content = f.filename + " (" + std::to_string(f.content.size()) + " bytes)";
+    res.set_content(content, "text/plain");
+});
+```
+
+マルチパートフォームで送られたファイルを受け取ります。`req.form.get_file("file")` で `"file"` という名前のフィールドを取得し、`f.filename` と `f.content.size()` でファイル名とサイズを返しています。
+
+### GET /users/:id
+
+```cpp
+svr.Get("/users/:id", [](const auto &req, auto &res) {
+    auto id = req.path_params.at("id");
+    res.set_content("User ID: " + id, "text/plain");
+});
+```
+
+`:id` の部分がパスパラメーターです。`req.path_params.at("id")` で値を取り出しています。`/users/42` なら `"42"`、`/users/alice` なら `"alice"` が得られます。
+
+### GET /files/(\d+)
+
+```cpp
+svr.Get(R"(/files/(\d+))", [](const auto &req, auto &res) {
+    auto id = req.matches[1];
+    res.set_content("File ID: " + std::string(id), "text/plain");
+});
+```
+
+正規表現 `(\d+)` で数字だけのIDにマッチします。`/files/42` にはマッチしますが、`/files/abc` は404になります。`req.matches[1]` で最初のキャプチャグループの値を取得しています。
+
+## 次のステップ
+
+サーバーの基本がわかりましたね。ルーティング、リクエストの読み取り、レスポンスの組み立て。これだけで、十分に実用的なAPIサーバーが作れます。
+
+次は、静的ファイルの配信を見てみましょう。HTMLやCSSを配信するサーバーを作ります。
+
+**次:** [Static File Server](../04-static-file-server)

docs-src/pages/ja/tour/04-static-file-server.md

@@ -0,0 +1,134 @@
+---
+title: "Static File Server"
+order: 4
+---
+
+cpp-httplibは、HTMLやCSS、画像ファイルなどの静的ファイルも配信できます。面倒な設定は要りません。`set_mount_point()` を1行呼ぶだけです。
+
+## set_mount_point の基本
+
+さっそくやってみましょう。`set_mount_point()` は、URLのパスとローカルディレクトリを紐づけます。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.set_mount_point("/", "./html");
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+第1引数がURLのマウントポイント、第2引数がローカルのディレクトリパスです。この例だと、`/` へのリクエストを `./html` ディレクトリから配信します。
+
+試してみましょう。まず `html` ディレクトリを作って、`index.html` を置きます。
+
+```sh
+mkdir html
+```
+
+```html
+<!DOCTYPE html>
+<html>
+<head><title>My Page</title></head>
+<body>
+    <h1>Hello from cpp-httplib!</h1>
+    <p>This is a static file.</p>
+</body>
+</html>
+```
+
+コンパイルして起動します。
+
+```sh
+g++ -std=c++17 -o server server.cpp -pthread
+./server
+```
+
+ブラウザで `http://localhost:8080` を開いてみてください。`html/index.html` の内容が表示されるはずです。`http://localhost:8080/index.html` でも同じページが返ります。
+
+もちろん、前章のクライアントコードや `curl` でもアクセスできますよ。
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+auto res = cli.Get("/");
+if (res) {
+    std::cout << res->body << std::endl;  // HTMLが表示される
+}
+```
+
+```sh
+curl http://localhost:8080
+```
+
+## 複数のマウントポイント
+
+`set_mount_point()` は何回でも呼べます。URLのパスごとに、別々のディレクトリを割り当てられます。
+
+```cpp
+svr.set_mount_point("/", "./public");
+svr.set_mount_point("/assets", "./static/assets");
+svr.set_mount_point("/docs", "./documentation");
+```
+
+`/assets/style.css` なら `./static/assets/style.css` を、`/docs/guide.html` なら `./documentation/guide.html` を配信します。
+
+## ハンドラーとの組み合わせ
+
+静的ファイルの配信と、前章で学んだルーティングハンドラーは共存できます。
+
+```cpp
+httplib::Server svr;
+
+// APIエンドポイント
+svr.Get("/api/hello", [](const auto &, auto &res) {
+    res.set_content(R"({"message":"Hello!"})", "application/json");
+});
+
+// 静的ファイル配信
+svr.set_mount_point("/", "./public");
+
+svr.listen("0.0.0.0", 8080);
+```
+
+ハンドラーが先に評価されます。`/api/hello` にはハンドラーが応答し、それ以外のパスは `./public` ディレクトリからファイルを探します。
+
+## レスポンスヘッダーの追加
+
+`set_mount_point()` の第3引数にヘッダーを渡すと、静的ファイルのレスポンスにカスタムヘッダーを付けられます。キャッシュ制御に便利です。
+
+```cpp
+svr.set_mount_point("/", "./public", {
+    {"Cache-Control", "max-age=3600"}
+});
+```
+
+こうすると、ブラウザは配信されたファイルを1時間キャッシュします。
+
+## 静的ファイルサーバー用のDockerファイル
+
+cpp-httplibのリポジトリには、静的ファイルサーバー用の `Dockerfile` が含まれています。Docker Hubにビルド済みイメージも公開しているので、1コマンドで起動できます。
+
+```sh
+> docker run -p 8080:80 -v ./my-site:/html yhirose4dockerhub/cpp-httplib-server
+Serving HTTP on 0.0.0.0:80
+Mount point: / -> ./html
+Press Ctrl+C to shutdown gracefully...
+192.168.65.1 - - [22/Feb/2026:12:00:00 +0000] "GET / HTTP/1.1" 200 256 "-" "Mozilla/5.0 ..."
+192.168.65.1 - - [22/Feb/2026:12:00:00 +0000] "GET /style.css HTTP/1.1" 200 1024 "-" "Mozilla/5.0 ..."
+192.168.65.1 - - [22/Feb/2026:12:00:01 +0000] "GET /favicon.ico HTTP/1.1" 404 152 "-" "Mozilla/5.0 ..."
+```
+
+`./my-site` ディレクトリの中身が、そのままポート8080で配信されます。NGINXと同じログ形式で、アクセスの様子を確認できますよ。
+
+## 次のステップ
+
+静的ファイルの配信ができるようになりましたね。HTMLやCSS、JavaScriptを配信するWebサーバーが、これだけのコードで作れます。
+
+次は、HTTPSで暗号化通信をしてみましょう。まずはTLSライブラリのセットアップからです。
+
+**次:** [TLS Setup](../05-tls-setup)

docs-src/pages/ja/tour/05-tls-setup.md

@@ -0,0 +1,88 @@
+---
+title: "TLS Setup"
+order: 5
+---
+
+ここまではHTTP（平文）でやってきましたが、実際のWebではHTTPS（暗号化通信）が当たり前ですよね。cpp-httplibでHTTPSを使うには、TLSライブラリが必要です。
+
+このTourではOpenSSLを使います。最も広く使われていて、情報も豊富です。
+
+## OpenSSLのインストール
+
+お使いのOSに合わせてインストールしましょう。
+
+| OS | インストール方法 |
+| -- | ---------------- |
+| macOS | [Homebrew](https://brew.sh/) (`brew install openssl`) |
+| Ubuntu / Debian | `sudo apt install libssl-dev` |
+| Windows | [vcpkg](https://vcpkg.io/) (`vcpkg install openssl`) |
+
+## コンパイルオプション
+
+TLS機能を有効にするには、`CPPHTTPLIB_OPENSSL_SUPPORT` マクロを定義してコンパイルします。前章までのコンパイルコマンドに、いくつかオプションが増えます。
+
+```sh
+# macOS (Homebrew)
+clang++ -std=c++17 -DCPPHTTPLIB_OPENSSL_SUPPORT \
+    -I$(brew --prefix openssl)/include \
+    -L$(brew --prefix openssl)/lib \
+    -lssl -lcrypto \
+    -framework CoreFoundation -framework Security \
+    -o server server.cpp
+
+# Linux
+clang++ -std=c++17 -pthread -DCPPHTTPLIB_OPENSSL_SUPPORT \
+    -lssl -lcrypto \
+    -o server server.cpp
+
+# Windows (Developer Command Prompt)
+cl /EHsc /std:c++17 /DCPPHTTPLIB_OPENSSL_SUPPORT server.cpp libssl.lib libcrypto.lib
+```
+
+それぞれのオプションの役割を見てみましょう。
+
+- **`-DCPPHTTPLIB_OPENSSL_SUPPORT`** — TLS機能を有効にするマクロ定義
+- **`-lssl -lcrypto`** — OpenSSLのライブラリをリンク
+- **`-I` / `-L`**（macOSのみ）— Homebrew版OpenSSLのパスを指定
+- **`-framework CoreFoundation -framework Security`**（macOSのみ）— Keychainからシステム証明書を自動で読み込むために必要です
+
+## 動作確認
+
+ちゃんと動くか確認してみましょう。`httplib::Client` にHTTPSのURLを渡してアクセスするだけのプログラムです。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://www.google.com");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << "Status: " << res->status << std::endl;
+    } else {
+        std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    }
+}
+```
+
+コンパイルして実行してみてください。`Status: 200` と表示されれば、セットアップ完了です。
+
+## 他のTLSバックエンド
+
+cpp-httplibはOpenSSL以外にも、Mbed TLSとwolfSSLに対応しています。マクロ定義とリンクするライブラリを変えるだけで切り替えられます。
+
+| バックエンド | マクロ定義 | リンクするライブラリ |
+| :--- | :--- | :--- |
+| OpenSSL | `CPPHTTPLIB_OPENSSL_SUPPORT` | `libssl`, `libcrypto` |
+| Mbed TLS | `CPPHTTPLIB_MBEDTLS_SUPPORT` | `libmbedtls`, `libmbedx509`, `libmbedcrypto` |
+| wolfSSL | `CPPHTTPLIB_WOLFSSL_SUPPORT` | `libwolfssl` |
+
+このTourではOpenSSLを前提に進めますが、APIはどのバックエンドでも共通です。
+
+## 次のステップ
+
+TLSの準備ができましたね。次は、HTTPSサイトにリクエストを送ってみましょう。
+
+**次:** [HTTPS Client](../06-https-client)

docs-src/pages/ja/tour/06-https-client.md

@@ -0,0 +1,122 @@
+---
+title: "HTTPS Client"
+order: 6
+---
+
+前章でOpenSSLのセットアップが済んだので、さっそくHTTPSクライアントを使ってみましょう。2章で使った `httplib::Client` がそのまま使えます。コンストラクタに `https://` 付きのURLを渡すだけです。
+
+## GETリクエスト
+
+実在するHTTPSサイトにアクセスしてみましょう。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://nghttp2.org");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->status << std::endl;           // 200
+        std::cout << res->body.substr(0, 100) << std::endl;  // HTMLの先頭部分
+    } else {
+        std::cout << "Error: " << httplib::to_string(res.error()) << std::endl;
+    }
+}
+```
+
+2章では `httplib::Client cli("http://localhost:8080")` と書きましたよね。スキームを `https://` に変えるだけです。`Get()` や `Post()` など、2章で学んだAPIはすべてそのまま使えます。
+
+```sh
+curl https://nghttp2.org/
+```
+
+## ポートの指定
+
+HTTPSのデフォルトポートは443です。別のポートを使いたい場合は、URLにポートを含めます。
+
+```cpp
+httplib::Client cli("https://localhost:8443");
+```
+
+## CA証明書の検証
+
+`httplib::Client` はHTTPS接続時、デフォルトでサーバー証明書を検証します。信頼できるCA（認証局）が発行した証明書を持つサーバーにしか接続しません。
+
+CA証明書は、macOSならKeychain、LinuxならシステムのCA証明書ストア、WindowsならWindowsの証明書ストアから自動で読み込みます。ほとんどの場合、追加の設定は要りません。
+
+### CA証明書ファイルの指定
+
+環境によってはシステムのCA証明書が見つからないこともあります。そのときは `set_ca_cert_path()` でパスを直接指定してください。
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+cli.set_ca_cert_path("/etc/ssl/certs/ca-certificates.crt");
+
+auto res = cli.Get("/");
+```
+
+```sh
+curl --cacert /etc/ssl/certs/ca-certificates.crt https://nghttp2.org/
+```
+
+### 証明書検証の無効化
+
+開発中、自己署名証明書のサーバーに接続したいときは、検証を無効にできます。
+
+```cpp
+httplib::Client cli("https://localhost:8443");
+cli.enable_server_certificate_verification(false);
+
+auto res = cli.Get("/");
+```
+
+```sh
+curl -k https://localhost:8443/
+```
+
+本番では絶対に無効にしないでください。中間者攻撃のリスクがあります。
+
+## リダイレクトの追跡
+
+HTTPSサイトへのアクセスでは、リダイレクトに遭遇することがよくあります。たとえば `http://` から `https://` へ、あるいは `www` なしから `www` ありへ転送されるケースです。
+
+デフォルトではリダイレクトを追跡しません。リダイレクト先は `Location` ヘッダーで確認できます。
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+
+auto res = cli.Get("/httpbin/redirect/3");
+if (res) {
+    std::cout << res->status << std::endl;  // 302
+    std::cout << res->get_header_value("Location") << std::endl;
+}
+```
+
+```sh
+curl https://nghttp2.org/httpbin/redirect/3
+```
+
+`set_follow_location(true)` を設定すると、リダイレクトを自動で追跡して、最終的なレスポンスを返してくれます。
+
+```cpp
+httplib::Client cli("https://nghttp2.org");
+cli.set_follow_location(true);
+
+auto res = cli.Get("/httpbin/redirect/3");
+if (res) {
+    std::cout << res->status << std::endl;  // 200（最終的なレスポンス）
+}
+```
+
+```sh
+curl -L https://nghttp2.org/httpbin/redirect/3
+```
+
+## 次のステップ
+
+HTTPSクライアントの使い方がわかりましたね。次は自分でHTTPSサーバーを立ててみましょう。自己署名証明書の作り方から始めます。
+
+**次:** [HTTPS Server](../07-https-server)

docs-src/pages/ja/tour/07-https-server.md

@@ -0,0 +1,124 @@
+---
+title: "HTTPS Server"
+order: 7
+---
+
+前章ではHTTPSクライアントを使いました。今度は自分でHTTPSサーバーを立ててみましょう。3章の `httplib::Server` を `httplib::SSLServer` に置き換えるだけです。
+
+ただし、TLSサーバーにはサーバー証明書と秘密鍵が必要です。まずはそこから準備しましょう。
+
+## 自己署名証明書の作成
+
+開発やテスト用なら、自己署名証明書（いわゆるオレオレ証明書）で十分です。OpenSSLのコマンドでサクッと作れます。
+
+```sh
+openssl req -x509 -noenc -keyout key.pem -out cert.pem -subj /CN=localhost
+```
+
+これで2つのファイルができます。
+
+- **`cert.pem`** — サーバー証明書
+- **`key.pem`** — 秘密鍵
+
+## 最小のHTTPSサーバー
+
+証明書ができたら、さっそくサーバーを書いてみましょう。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::SSLServer svr("cert.pem", "key.pem");
+
+    svr.Get("/", [](const auto &, auto &res) {
+        res.set_content("Hello, HTTPS!", "text/plain");
+    });
+
+    std::cout << "Listening on https://localhost:8443" << std::endl;
+    svr.listen("0.0.0.0", 8443);
+}
+```
+
+`httplib::SSLServer` のコンストラクタに証明書と秘密鍵のパスを渡すだけです。ルーティングの書き方は3章の `httplib::Server` とまったく同じですよ。
+
+コンパイルして起動しましょう。
+
+## 動作確認
+
+サーバーが起動したら、`curl` でアクセスしてみましょう。自己署名証明書なので、`-k` オプションで証明書検証をスキップします。
+
+```sh
+curl -k https://localhost:8443/
+# Hello, HTTPS!
+```
+
+ブラウザで `https://localhost:8443` を開くと、「この接続は安全ではありません」と警告が出ます。自己署名証明書なので正常です。気にせず進めてください。
+
+## クライアントからの接続
+
+前章の `httplib::Client` で接続してみましょう。自己署名証明書のサーバーに接続するには、2つの方法があります。
+
+### 方法1: 証明書検証を無効にする
+
+開発時の手軽な方法です。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://localhost:8443");
+    cli.enable_server_certificate_verification(false);
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->body << std::endl;  // Hello, HTTPS!
+    }
+}
+```
+
+### 方法2: 自己署名証明書をCA証明書として指定する
+
+こちらのほうが安全です。`cert.pem` をCA証明書として信頼するよう指定します。
+
+```cpp
+#define CPPHTTPLIB_OPENSSL_SUPPORT
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Client cli("https://localhost:8443");
+    cli.set_ca_cert_path("cert.pem");
+
+    auto res = cli.Get("/");
+    if (res) {
+        std::cout << res->body << std::endl;  // Hello, HTTPS!
+    }
+}
+```
+
+この方法なら、指定した証明書のサーバーにだけ接続を許可して、なりすましを防げます。テスト環境でもなるべくこちらを使いましょう。
+
+## Server と SSLServer の比較
+
+3章で学んだ `httplib::Server` のAPIは、`httplib::SSLServer` でもそのまま使えます。違いはコンストラクタだけです。
+
+| | `httplib::Server` | `httplib::SSLServer` |
+| -- | ------------------ | -------------------- |
+| コンストラクタ | 引数なし | 証明書と秘密鍵のパス |
+| プロトコル | HTTP | HTTPS |
+| ポート（慣例） | 8080 | 8443 |
+| ルーティング | 共通 | 共通 |
+
+HTTPサーバーをHTTPSに切り替えるには、コンストラクタを変えるだけです。
+
+## 次のステップ
+
+HTTPSサーバーが動きましたね。これでHTTP/HTTPSのクライアントとサーバー、両方の基本がそろいました。
+
+次は、cpp-httplibに新しく加わったWebSocket機能を見てみましょう。
+
+**次:** [WebSocket](../08-websocket)

docs-src/pages/ja/tour/08-websocket.md

@@ -0,0 +1,139 @@
+---
+title: "WebSocket"
+order: 8
+---
+
+cpp-httplibはWebSocketにも対応しています。HTTPのリクエスト/レスポンスと違い、WebSocketはサーバーとクライアントが双方向にメッセージをやり取りできます。チャットやリアルタイム通知に便利です。
+
+さっそく、エコーサーバーとクライアントを作ってみましょう。
+
+## エコーサーバー
+
+受け取ったメッセージをそのまま返すエコーサーバーです。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::Server svr;
+
+    svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+        std::string msg;
+        while (ws.read(msg)) {
+            ws.send(msg);  // 受け取ったメッセージをそのまま返す
+        }
+    });
+
+    std::cout << "Listening on port 8080..." << std::endl;
+    svr.listen("0.0.0.0", 8080);
+}
+```
+
+`svr.WebSocket()` でWebSocketハンドラーを登録します。3章の `svr.Get()` や `svr.Post()` と同じ感覚ですね。
+
+ハンドラーの中では、`ws.read(msg)` でメッセージを待ちます。接続が閉じられると `read()` が `false` を返すので、ループを抜けます。`ws.send(msg)` でメッセージを送り返します。
+
+## クライアントからの接続
+
+`httplib::ws::WebSocketClient` を使ってサーバーに接続してみましょう。
+
+```cpp
+#include "httplib.h"
+#include <iostream>
+
+int main() {
+    httplib::ws::WebSocketClient client("ws://localhost:8080/ws");
+
+    if (!client.connect()) {
+        std::cout << "Connection failed" << std::endl;
+        return 1;
+    }
+
+    // メッセージを送信
+    client.send("Hello, WebSocket!");
+
+    // サーバーからの応答を受信
+    std::string msg;
+    if (client.read(msg)) {
+        std::cout << msg << std::endl;  // Hello, WebSocket!
+    }
+
+    client.close();
+}
+```
+
+コンストラクタには `ws://host:port/path` 形式のURLを渡します。`connect()` で接続を開始し、`send()` と `read()` でメッセージをやり取りします。
+
+## テキストとバイナリ
+
+WebSocketにはテキストとバイナリの2種類のメッセージがあります。`read()` の戻り値で区別できます。
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    httplib::ws::ReadResult ret;
+    while ((ret = ws.read(msg))) {
+        if (ret == httplib::ws::Binary) {
+            ws.send(msg.data(), msg.size());  // バイナリとして送信
+        } else {
+            ws.send(msg);  // テキストとして送信
+        }
+    }
+});
+```
+
+- `ws.send(const std::string &)` — テキストメッセージとして送信
+- `ws.send(const char *, size_t)` — バイナリメッセージとして送信
+
+クライアント側も同じAPIです。
+
+## リクエスト情報へのアクセス
+
+ハンドラーの第1引数 `req` から、ハンドシェイク時のHTTPリクエスト情報を読み取れます。認証トークンの確認などに便利です。
+
+```cpp
+svr.WebSocket("/ws", [](const httplib::Request &req, httplib::ws::WebSocket &ws) {
+    auto token = req.get_header_value("Authorization");
+    if (token.empty()) {
+        ws.close(httplib::ws::CloseStatus::PolicyViolation, "unauthorized");
+        return;
+    }
+
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send(msg);
+    }
+});
+```
+
+## WSSで使う
+
+HTTPS上のWebSocket（WSS）にも対応しています。サーバー側は `httplib::SSLServer` にWebSocketハンドラーを登録するだけです。
+
+```cpp
+httplib::SSLServer svr("cert.pem", "key.pem");
+
+svr.WebSocket("/ws", [](const httplib::Request &, httplib::ws::WebSocket &ws) {
+    std::string msg;
+    while (ws.read(msg)) {
+        ws.send(msg);
+    }
+});
+
+svr.listen("0.0.0.0", 8443);
+```
+
+クライアント側は `wss://` スキームを使います。
+
+```cpp
+httplib::ws::WebSocketClient client("wss://localhost:8443/ws");
+```
+
+## 次のステップ
+
+WebSocketの基本がわかりましたね。ここまでで Tourは終わりです。
+
+次のページでは、Tourで取り上げなかった機能をまとめて紹介します。
+
+**次:** [What's Next](../09-whats-next)

docs-src/pages/ja/tour/09-whats-next.md

@@ -0,0 +1,228 @@
+---
+title: "What's Next"
+order: 9
+---
+
+Tourお疲れさまでした！ cpp-httplibの基本はひと通り押さえましたね。でも、まだまだ便利な機能があります。Tourで取り上げなかった機能をカテゴリー別に紹介します。
+
+## Streaming API
+
+LLMのストリーミング応答や大きなファイルのダウンロードでは、レスポンス全体をメモリに載せたくないですよね。`stream::Get()` を使えば、データをチャンクごとに処理できます。
+
+```cpp
+httplib::Client cli("http://localhost:11434");
+
+auto result = httplib::stream::Get(cli, "/api/generate");
+
+if (result) {
+    while (result.next()) {
+        std::cout.write(result.data(), result.size());
+    }
+}
+```
+
+`Get()` に `content_receiver` コールバックを渡す方法もあります。こちらはKeep-Aliveと併用できます。
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+
+cli.Get("/stream", [](const char *data, size_t len) {
+    std::cout.write(data, len);
+    return true;
+});
+```
+
+サーバー側には `set_content_provider()` と `set_chunked_content_provider()` があります。サイズがわかっているなら前者、不明なら後者を使ってください。
+
+```cpp
+// サイズ指定あり（Content-Length が設定される）
+svr.Get("/file", [](const auto &, auto &res) {
+    auto size = get_file_size("large.bin");
+    res.set_content_provider(size, "application/octet-stream",
+        [](size_t offset, size_t length, httplib::DataSink &sink) {
+            // offset から length バイト分を送る
+            return true;
+        });
+});
+
+// サイズ不明（Chunked Transfer Encoding）
+svr.Get("/stream", [](const auto &, auto &res) {
+    res.set_chunked_content_provider("text/plain",
+        [](size_t offset, httplib::DataSink &sink) {
+            sink.write("chunk\n", 6);
+            return true;  // falseを返すと終了
+        });
+});
+```
+
+大きなファイルのアップロードには `make_file_provider()` が便利です。ファイルを全部メモリに読み込まず、ストリーミングで送れます。
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+
+auto res = cli.Post("/upload", {}, {
+    httplib::make_file_provider("file", "/path/to/large-file.zip")
+});
+```
+
+## Server-Sent Events (SSE)
+
+SSEクライアントも用意しています。自動再接続や `Last-Event-ID` による再開にも対応しています。
+
+```cpp
+httplib::Client cli("http://localhost:8080");
+httplib::sse::SSEClient sse(cli, "/events");
+
+sse.on_message([](const httplib::sse::SSEMessage &msg) {
+    std::cout << msg.event << ": " << msg.data << std::endl;
+});
+
+sse.start();  // ブロッキング、自動再接続あり
+```
+
+イベントタイプごとにハンドラーを分けることもできますよ。
+
+```cpp
+sse.on_event("update", [](const httplib::sse::SSEMessage &msg) {
+    // "update" イベントだけ処理
+});
+```
+
+## 認証
+
+クライアントにはBasic認証、Bearer Token認証、Digest認証のヘルパーを用意しています。
+
+```cpp
+httplib::Client cli("https://api.example.com");
+cli.set_basic_auth("user", "password");
+cli.set_bearer_token_auth("my-token");
+```
+
+## 圧縮
+
+gzip、Brotli、Zstandardによる圧縮・展開に対応しています。使いたい方式のマクロを定義してコンパイルしましょう。
+
+| 圧縮方式 | マクロ定義 |
+| -- | -- |
+| gzip | `CPPHTTPLIB_ZLIB_SUPPORT` |
+| Brotli | `CPPHTTPLIB_BROTLI_SUPPORT` |
+| Zstandard | `CPPHTTPLIB_ZSTD_SUPPORT` |
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_compress(true);    // リクエストボディを圧縮
+cli.set_decompress(true);  // レスポンスボディを展開
+```
+
+## プロキシ
+
+HTTPプロキシ経由で接続できます。
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_proxy("proxy.example.com", 8080);
+cli.set_proxy_basic_auth("user", "password");
+```
+
+## タイムアウト
+
+接続・読み取り・書き込みのタイムアウトを個別に設定できます。
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_connection_timeout(5, 0);  // 5秒
+cli.set_read_timeout(10, 0);       // 10秒
+cli.set_write_timeout(10, 0);      // 10秒
+```
+
+## Keep-Alive
+
+同じサーバーに何度もリクエストするなら、Keep-Aliveを有効にしましょう。TCP接続を再利用するので効率的です。
+
+```cpp
+httplib::Client cli("https://example.com");
+cli.set_keep_alive(true);
+```
+
+## サーバーのミドルウェア
+
+リクエスト処理の前後にフックを挟めます。
+
+```cpp
+svr.set_pre_routing_handler([](const auto &req, auto &res) {
+    // すべてのリクエストの前に実行される
+    return httplib::Server::HandlerResponse::Unhandled;  // 通常のルーティングに進む
+});
+
+svr.set_post_routing_handler([](const auto &req, auto &res) {
+    // レスポンスが返された後に実行される
+    res.set_header("X-Server", "cpp-httplib");
+});
+```
+
+`req.user_data` を使うと、ミドルウェアからハンドラーにデータを渡せます。認証トークンのデコード結果を共有するときに便利です。
+
+```cpp
+svr.set_pre_routing_handler([](const auto &req, auto &res) {
+    req.user_data["auth_user"] = std::string("alice");
+    return httplib::Server::HandlerResponse::Unhandled;
+});
+
+svr.Get("/me", [](const auto &req, auto &res) {
+    auto user = std::any_cast<std::string>(req.user_data.at("auth_user"));
+    res.set_content("Hello, " + user, "text/plain");
+});
+```
+
+エラーや例外のハンドラーもカスタマイズできますよ。
+
+```cpp
+svr.set_error_handler([](const auto &req, auto &res) {
+    res.set_content("Custom Error Page", "text/html");
+});
+
+svr.set_exception_handler([](const auto &req, auto &res, std::exception_ptr ep) {
+    res.status = 500;
+    res.set_content("Internal Server Error", "text/plain");
+});
+```
+
+## ロギング
+
+サーバーでもクライアントでもロガーを設定できます。
+
+```cpp
+svr.set_logger([](const auto &req, const auto &res) {
+    std::cout << req.method << " " << req.path << " " << res.status << std::endl;
+});
+```
+
+## Unix Domain Socket
+
+TCP以外に、Unix Domain Socketでの通信にも対応しています。同じマシン上のプロセス間通信に使えます。
+
+```cpp
+// サーバー
+httplib::Server svr;
+svr.set_address_family(AF_UNIX);
+svr.listen("/tmp/httplib.sock", 0);
+```
+
+```cpp
+// クライアント
+httplib::Client cli("http://localhost");
+cli.set_address_family(AF_UNIX);
+cli.set_hostname_addr_map({{"localhost", "/tmp/httplib.sock"}});
+
+auto res = cli.Get("/");
+```
+
+## さらに詳しく
+
+もっと詳しく知りたいときは、以下を参照してください。
+
+- Cookbook — よくあるユースケースのレシピ集
+- [README](https://github.com/yhirose/cpp-httplib/blob/master/README.md) — 全APIのリファレンス
+- [README-sse](https://github.com/yhirose/cpp-httplib/blob/master/README-sse.md) — Server-Sent Eventsの使い方
+- [README-stream](https://github.com/yhirose/cpp-httplib/blob/master/README-stream.md) — Streaming APIの使い方
+- [README-websocket](https://github.com/yhirose/cpp-httplib/blob/master/README-websocket.md) — WebSocketサーバーの使い方

docs-src/pages/ja/tour/index.md

@@ -0,0 +1,16 @@
+---
+title: "A Tour of cpp-httplib"
+order: 0
+---
+
+cpp-httplibの基本を、順番に学んでいくチュートリアルです。各章は前の章の内容を踏まえて進む構成なので、1章から順に読んでください。
+
+1. [Getting Started](01-getting-started) — httplib.h の入手とHello Worldサーバー
+2. [Basic Client](02-basic-client) — GET/POST・パスパラメーターのリクエスト送信
+3. [Basic Server](03-basic-server) — ルーティング、パスパラメーター、レスポンスの組み立て
+4. [Static File Server](04-static-file-server) — 静的ファイルの配信
+5. [TLS Setup](05-tls-setup) — OpenSSL / mbedTLS のセットアップ
+6. [HTTPS Client](06-https-client) — HTTPSサイトへのリクエスト
+7. [HTTPS Server](07-https-server) — HTTPSサーバーの構築
+8. [WebSocket](08-websocket) — WebSocket通信の基本
+9. [What's Next](09-whats-next) — さらなる機能の紹介

httplib.h

@@ -8,28 +8,8 @@
 #ifndef CPPHTTPLIB_HTTPLIB_H
 #define CPPHTTPLIB_HTTPLIB_H
 
-#define CPPHTTPLIB_VERSION "0.34.0"
-#define CPPHTTPLIB_VERSION_NUM "0x002200"
-
-/*
- * Platform compatibility check
- */
-
-#if defined(_WIN32) && !defined(_WIN64)
-#if defined(_MSC_VER)
-#pragma message(                                                               \
-    "cpp-httplib doesn't support 32-bit Windows. Please use a 64-bit compiler.")
-#else
-#warning                                                                       \
-    "cpp-httplib doesn't support 32-bit Windows. Please use a 64-bit compiler."
-#endif
-#elif defined(__SIZEOF_POINTER__) && __SIZEOF_POINTER__ < 8
-#warning                                                                       \
-    "cpp-httplib doesn't support 32-bit platforms. Please use a 64-bit compiler."
-#elif defined(__SIZEOF_SIZE_T__) && __SIZEOF_SIZE_T__ < 8
-#warning                                                                       \
-    "cpp-httplib doesn't support platforms where size_t is less than 64 bits."
-#endif
+#define CPPHTTPLIB_VERSION "0.37.2"
+#define CPPHTTPLIB_VERSION_NUM "0x002502"
 
 #ifdef _WIN32
 #if defined(_WIN32_WINNT) && _WIN32_WINNT < 0x0A00
@@ -357,14 +337,32 @@ using socket_t = int;
 #include <any>
 #endif
 
+// On macOS with a TLS backend, enable Keychain root certificates by default
+// unless the user explicitly opts out.
+#if defined(__APPLE__) &&                                                      \
+    !defined(CPPHTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES) &&         \
+    (defined(CPPHTTPLIB_OPENSSL_SUPPORT) ||                                    \
+     defined(CPPHTTPLIB_MBEDTLS_SUPPORT) ||                                    \
+     defined(CPPHTTPLIB_WOLFSSL_SUPPORT))
+#ifndef CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN
+#define CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN
+#endif
+#endif
+
+// On Windows, enable Schannel certificate verification by default
+// unless the user explicitly opts out.
+#if defined(_WIN32) &&                                                         \
+    !defined(CPPHTTPLIB_DISABLE_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE)
+#define CPPHTTPLIB_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE
+#endif
+
 #if defined(CPPHTTPLIB_USE_NON_BLOCKING_GETADDRINFO) ||                        \
     defined(CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN)
 #if TARGET_OS_MAC
 #include <CFNetwork/CFHost.h>
 #include <CoreFoundation/CoreFoundation.h>
 #endif
-#endif // CPPHTTPLIB_USE_NON_BLOCKING_GETADDRINFO or
-       // CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN
+#endif
 
 #ifdef CPPHTTPLIB_OPENSSL_SUPPORT
 #ifdef _WIN32
@@ -382,11 +380,11 @@ using socket_t = int;
 #endif
 #endif // _WIN32
 
-#if defined(CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN)
+#ifdef CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN
 #if TARGET_OS_MAC
 #include <Security/Security.h>
 #endif
-#endif // CPPHTTPLIB_USE_NON_BLOCKING_GETADDRINFO
+#endif
 
 #include <openssl/err.h>
 #include <openssl/evp.h>
@@ -430,11 +428,11 @@ using socket_t = int;
 #pragma comment(lib, "crypt32.lib")
 #endif
 #endif // _WIN32
-#if defined(CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN)
+#ifdef CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN
 #if TARGET_OS_MAC
 #include <Security/Security.h>
 #endif
-#endif // CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN
+#endif
 
 // Mbed TLS 3.x API compatibility
 #if MBEDTLS_VERSION_MAJOR >= 3
@@ -473,11 +471,11 @@ using socket_t = int;
 #pragma comment(lib, "crypt32.lib")
 #endif
 #endif // _WIN32
-#if defined(CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN)
+#ifdef CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN
 #if TARGET_OS_MAC
 #include <Security/Security.h>
 #endif
-#endif // CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN
+#endif
 #endif // CPPHTTPLIB_WOLFSSL_SUPPORT
 
 // Define CPPHTTPLIB_SSL_ENABLED if any SSL backend is available
@@ -557,6 +555,14 @@ inline unsigned char to_lower(int c) {
   return table[(unsigned char)(char)c];
 }
 
+inline std::string to_lower(const std::string &s) {
+  std::string result = s;
+  std::transform(
+      result.begin(), result.end(), result.begin(),
+      [](unsigned char c) { return static_cast<char>(to_lower(c)); });
+  return result;
+}
+
 inline bool equal(const std::string &a, const std::string &b) {
   return a.size() == b.size() &&
          std::equal(a.begin(), a.end(), b.begin(), [](char ca, char cb) {
@@ -683,6 +689,18 @@ inline from_chars_result<double> from_chars(const char *first, const char *last,
   return {first + (endptr - s.c_str()), std::errc{}};
 }
 
+inline bool parse_port(const char *s, size_t len, int &port) {
+  int val = 0;
+  auto r = from_chars(s, s + len, val);
+  if (r.ec != std::errc{} || val < 1 || val > 65535) { return false; }
+  port = val;
+  return true;
+}
+
+inline bool parse_port(const std::string &s, int &port) {
+  return parse_port(s.data(), s.size(), port);
+}
+
 } // namespace detail
 
 enum SSLVerifierResponse {
@@ -1845,23 +1863,23 @@ public:
       : res_(std::move(res)), err_(err),
         request_headers_(std::move(request_headers)), ssl_error_(ssl_error) {}
   Result(std::unique_ptr<Response> &&res, Error err, Headers &&request_headers,
-         int ssl_error, unsigned long ssl_backend_error)
+         int ssl_error, uint64_t ssl_backend_error)
       : res_(std::move(res)), err_(err),
         request_headers_(std::move(request_headers)), ssl_error_(ssl_error),
         ssl_backend_error_(ssl_backend_error) {}
 
   int ssl_error() const { return ssl_error_; }
-  unsigned long ssl_backend_error() const { return ssl_backend_error_; }
+  uint64_t ssl_backend_error() const { return ssl_backend_error_; }
 
 private:
   int ssl_error_ = 0;
-  unsigned long ssl_backend_error_ = 0;
+  uint64_t ssl_backend_error_ = 0;
 #endif
 
 #ifdef CPPHTTPLIB_OPENSSL_SUPPORT
 public:
   [[deprecated("Use ssl_backend_error() instead")]]
-  unsigned long ssl_openssl_error() const {
+  uint64_t ssl_openssl_error() const {
     return ssl_backend_error_;
   }
 #endif
@@ -2331,7 +2349,7 @@ protected:
   bool server_hostname_verification_ = true;
   std::string ca_cert_pem_; // Store CA cert PEM for redirect transfer
   int last_ssl_error_ = 0;
-  unsigned long last_backend_error_ = 0;
+  uint64_t last_backend_error_ = 0;
 #endif
 
 #ifdef CPPHTTPLIB_OPENSSL_SUPPORT
@@ -2561,8 +2579,7 @@ public:
 
   tls::ctx_t tls_context() const;
 
-#if defined(_WIN32) &&                                                         \
-    !defined(CPPHTTPLIB_DISABLE_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE)
+#ifdef CPPHTTPLIB_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE
   void enable_windows_certificate_verification(bool enabled);
 #endif
 
@@ -2683,8 +2700,7 @@ public:
 
   tls::ctx_t tls_context() const { return ctx_; }
 
-#if defined(_WIN32) &&                                                         \
-    !defined(CPPHTTPLIB_DISABLE_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE)
+#ifdef CPPHTTPLIB_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE
   void enable_windows_certificate_verification(bool enabled);
 #endif
 
@@ -2716,8 +2732,7 @@ private:
 
   std::function<SSLVerifierResponse(tls::session_t)> session_verifier_;
 
-#if defined(_WIN32) &&                                                         \
-    !defined(CPPHTTPLIB_DISABLE_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE)
+#ifdef CPPHTTPLIB_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE
   bool enable_windows_cert_verification_ = true;
 #endif
 
@@ -2778,7 +2793,7 @@ inline size_t get_header_value_u64(const Headers &headers,
   std::advance(it, static_cast<ssize_t>(id));
   if (it != rng.second) {
     if (is_numeric(it->second)) {
-      return std::strtoull(it->second.data(), nullptr, 10);
+      return static_cast<size_t>(std::strtoull(it->second.data(), nullptr, 10));
     } else {
       is_invalid_value = true;
     }
@@ -4607,17 +4622,13 @@ inline bool is_websocket_upgrade(const Request &req) {
   // Check Upgrade: websocket (case-insensitive)
   auto upgrade_it = req.headers.find("Upgrade");
   if (upgrade_it == req.headers.end()) { return false; }
-  auto upgrade_val = upgrade_it->second;
-  std::transform(upgrade_val.begin(), upgrade_val.end(), upgrade_val.begin(),
-                 ::tolower);
+  auto upgrade_val = case_ignore::to_lower(upgrade_it->second);
   if (upgrade_val != "websocket") { return false; }
 
   // Check Connection header contains "Upgrade"
   auto connection_it = req.headers.find("Connection");
   if (connection_it == req.headers.end()) { return false; }
-  auto connection_val = connection_it->second;
-  std::transform(connection_val.begin(), connection_val.end(),
-                 connection_val.begin(), ::tolower);
+  auto connection_val = case_ignore::to_lower(connection_it->second);
   if (connection_val.find("upgrade") == std::string::npos) { return false; }
 
   // Check Sec-WebSocket-Key is a valid base64-encoded 16-byte value (24 chars)
@@ -5793,9 +5804,9 @@ inline int getaddrinfo_with_timeout(const char *node, const char *service,
     memcpy((*current)->ai_addr, sockaddr_ptr, sockaddr_len);
 
     // Set port if service is specified
-    if (service && strlen(service) > 0) {
-      int port = atoi(service);
-      if (port > 0) {
+    if (service && *service) {
+      int port = 0;
+      if (parse_port(service, strlen(service), port)) {
         if (sockaddr_ptr->sa_family == AF_INET) {
           reinterpret_cast<struct sockaddr_in *>((*current)->ai_addr)
               ->sin_port = htons(static_cast<uint16_t>(port));
@@ -6365,22 +6376,63 @@ find_content_type(const std::string &path,
   }
 }
 
+inline std::string
+extract_media_type(const std::string &content_type,
+                   std::map<std::string, std::string> *params = nullptr) {
+  // Extract type/subtype from Content-Type value (RFC 2045)
+  // e.g. "application/json; charset=utf-8" -> "application/json"
+  auto media_type = content_type;
+  auto semicolon_pos = media_type.find(';');
+  if (semicolon_pos != std::string::npos) {
+    auto param_str = media_type.substr(semicolon_pos + 1);
+    media_type = media_type.substr(0, semicolon_pos);
+
+    if (params) {
+      // Parse parameters: key=value pairs separated by ';'
+      split(param_str.data(), param_str.data() + param_str.size(), ';',
+            [&](const char *b, const char *e) {
+              std::string key;
+              std::string val;
+              split(b, e, '=', [&](const char *b2, const char *e2) {
+                if (key.empty()) {
+                  key.assign(b2, e2);
+                } else {
+                  val.assign(b2, e2);
+                }
+              });
+              if (!key.empty()) {
+                params->emplace(trim_copy(key), trim_double_quotes_copy(val));
+              }
+            });
+    }
+  }
+
+  // Trim whitespace from media type
+  return trim_copy(media_type);
+}
+
 inline bool can_compress_content_type(const std::string &content_type) {
   using udl::operator""_t;
 
-  auto tag = str2tag(content_type);
+  auto mime_type = extract_media_type(content_type);
+  auto tag = str2tag(mime_type);
 
   switch (tag) {
   case "image/svg+xml"_t:
   case "application/javascript"_t:
+  case "application/x-javascript"_t:
   case "application/json"_t:
+  case "application/ld+json"_t:
   case "application/xml"_t:
-  case "application/protobuf"_t:
-  case "application/xhtml+xml"_t: return true;
+  case "application/xhtml+xml"_t:
+  case "application/rss+xml"_t:
+  case "application/atom+xml"_t:
+  case "application/xslt+xml"_t:
+  case "application/protobuf"_t: return true;
 
   case "text/event-stream"_t: return false;
 
-  default: return !content_type.rfind("text/", 0);
+  default: return !mime_type.rfind("text/", 0);
   }
 }
 
@@ -6773,6 +6825,16 @@ inline bool read_headers(Stream &strm, Headers &headers) {
     header_count++;
   }
 
+  // RFC 9110 Section 8.6: Reject requests with multiple Content-Length
+  // headers that have different values to prevent request smuggling.
+  auto cl_range = headers.equal_range("Content-Length");
+  if (cl_range.first != cl_range.second) {
+    const auto &first_val = cl_range.first->second;
+    for (auto it = std::next(cl_range.first); it != cl_range.second; ++it) {
+      if (it->second != first_val) { return false; }
+    }
+  }
+
   return true;
 }
 
@@ -6796,17 +6858,13 @@ inline bool read_websocket_upgrade_response(Stream &strm,
   // Verify Upgrade: websocket (case-insensitive)
   auto upgrade_it = headers.find("Upgrade");
   if (upgrade_it == headers.end()) { return false; }
-  auto upgrade_val = upgrade_it->second;
-  std::transform(upgrade_val.begin(), upgrade_val.end(), upgrade_val.begin(),
-                 ::tolower);
+  auto upgrade_val = case_ignore::to_lower(upgrade_it->second);
   if (upgrade_val != "websocket") { return false; }
 
   // Verify Connection header contains "Upgrade" (case-insensitive)
   auto connection_it = headers.find("Connection");
   if (connection_it == headers.end()) { return false; }
-  auto connection_val = connection_it->second;
-  std::transform(connection_val.begin(), connection_val.end(),
-                 connection_val.begin(), ::tolower);
+  auto connection_val = case_ignore::to_lower(connection_it->second);
   if (connection_val.find("upgrade") == std::string::npos) { return false; }
 
   // Verify Sec-WebSocket-Accept header value
@@ -6935,7 +6993,8 @@ inline bool is_chunked_transfer_encoding(const Headers &headers) {
 template <typename T, typename U>
 bool prepare_content_receiver(T &x, int &status,
                               ContentReceiverWithProgress receiver,
-                              bool decompress, U callback) {
+                              bool decompress, size_t payload_max_length,
+                              bool &exceed_payload_max_length, U callback) {
   if (decompress) {
     std::string encoding = x.get_header_value("Content-Encoding");
     std::unique_ptr<decompressor> decompressor;
@@ -6951,12 +7010,22 @@ bool prepare_content_receiver(T &x, int &status,
 
     if (decompressor) {
       if (decompressor->is_valid()) {
+        size_t decompressed_size = 0;
         ContentReceiverWithProgress out = [&](const char *buf, size_t n,
                                               size_t off, size_t len) {
-          return decompressor->decompress(buf, n,
-                                          [&](const char *buf2, size_t n2) {
-                                            return receiver(buf2, n2, off, len);
-                                          });
+          return decompressor->decompress(
+              buf, n, [&](const char *buf2, size_t n2) {
+                // Guard against zip-bomb: check
+                // decompressed size against limit.
+                if (payload_max_length > 0 &&
+                    (decompressed_size >= payload_max_length ||
+                     n2 > payload_max_length - decompressed_size)) {
+                  exceed_payload_max_length = true;
+                  return false;
+                }
+                decompressed_size += n2;
+                return receiver(buf2, n2, off, len);
+              });
         };
         return callback(std::move(out));
       } else {
@@ -6977,11 +7046,14 @@ template <typename T>
 bool read_content(Stream &strm, T &x, size_t payload_max_length, int &status,
                   DownloadProgress progress,
                   ContentReceiverWithProgress receiver, bool decompress) {
+  bool exceed_payload_max_length = false;
   return prepare_content_receiver(
-      x, status, std::move(receiver), decompress,
-      [&](const ContentReceiverWithProgress &out) {
+      x, status, std::move(receiver), decompress, payload_max_length,
+      exceed_payload_max_length, [&](const ContentReceiverWithProgress &out) {
         auto ret = true;
-        auto exceed_payload_max_length = false;
+        // Note: exceed_payload_max_length may also be set by the decompressor
+        // wrapper in prepare_content_receiver when the decompressed payload
+        // size exceeds the limit.
 
         if (is_chunked_transfer_encoding(x.headers)) {
           auto result = read_content_chunked(strm, x, payload_max_length, out);
@@ -7397,12 +7469,11 @@ inline std::string normalize_query_string(const std::string &query) {
 
 inline bool parse_multipart_boundary(const std::string &content_type,
                                      std::string &boundary) {
-  auto boundary_keyword = "boundary=";
-  auto pos = content_type.find(boundary_keyword);
-  if (pos == std::string::npos) { return false; }
-  auto end = content_type.find(';', pos);
-  auto beg = pos + strlen(boundary_keyword);
-  boundary = trim_double_quotes_copy(content_type.substr(beg, end - beg));
+  std::map<std::string, std::string> params;
+  extract_media_type(content_type, &params);
+  auto it = params.find("boundary");
+  if (it == params.end()) { return false; }
+  boundary = it->second;
   return !boundary.empty();
 }
 
@@ -7570,11 +7641,7 @@ inline bool parse_accept_header(const std::string &s,
     }
 
     // Remove additional parameters from media type
-    auto param_pos = accept_entry.media_type.find(';');
-    if (param_pos != std::string::npos) {
-      accept_entry.media_type =
-          trim_copy(accept_entry.media_type.substr(0, param_pos));
-    }
+    accept_entry.media_type = extract_media_type(accept_entry.media_type);
 
     // Basic validation of media type format
     if (accept_entry.media_type.empty()) {
@@ -7683,14 +7750,10 @@ public:
             file_.content_type =
                 trim_copy(header.substr(str_len(header_content_type)));
           } else {
-            thread_local const std::regex re_content_disposition(
-                R"~(^Content-Disposition:\s*form-data;\s*(.*)$)~",
-                std::regex_constants::icase);
-
-            std::smatch m;
-            if (std::regex_match(header, m, re_content_disposition)) {
+            std::string disposition_params;
+            if (parse_content_disposition(header, disposition_params)) {
               Params params;
-              parse_disposition_params(m[1], params);
+              parse_disposition_params(disposition_params, params);
 
               auto it = params.find("name");
               if (it != params.end()) {
@@ -7705,13 +7768,14 @@ public:
 
               it = params.find("filename*");
               if (it != params.end()) {
-                // Only allow UTF-8 encoding...
-                thread_local const std::regex re_rfc5987_encoding(
-                    R"~(^UTF-8''(.+?)$)~", std::regex_constants::icase);
-
-                std::smatch m2;
-                if (std::regex_match(it->second, m2, re_rfc5987_encoding)) {
-                  file_.filename = decode_path_component(m2[1]); // override...
+                // RFC 5987: only UTF-8 encoding is allowed
+                const auto &val = it->second;
+                constexpr const char utf8_prefix[] = "UTF-8''";
+                constexpr size_t prefix_len = str_len(utf8_prefix);
+                if (val.size() > prefix_len &&
+                    start_with_case_ignore(val, utf8_prefix)) {
+                  file_.filename = decode_path_component(
+                      val.substr(prefix_len)); // override...
                 } else {
                   is_valid_ = false;
                   return false;
@@ -7779,17 +7843,48 @@ private:
     file_.headers.clear();
   }
 
-  bool start_with_case_ignore(const std::string &a, const char *b) const {
+  bool start_with_case_ignore(const std::string &a, const char *b,
+                              size_t offset = 0) const {
     const auto b_len = strlen(b);
-    if (a.size() < b_len) { return false; }
+    if (a.size() < offset + b_len) { return false; }
     for (size_t i = 0; i < b_len; i++) {
-      if (case_ignore::to_lower(a[i]) != case_ignore::to_lower(b[i])) {
+      if (case_ignore::to_lower(a[offset + i]) != case_ignore::to_lower(b[i])) {
         return false;
       }
     }
     return true;
   }
 
+  // Parses "Content-Disposition: form-data; <params>" without std::regex.
+  // Returns true if header matches, with the params portion in `params_out`.
+  bool parse_content_disposition(const std::string &header,
+                                 std::string &params_out) const {
+    constexpr const char prefix[] = "Content-Disposition:";
+    constexpr size_t prefix_len = str_len(prefix);
+
+    if (!start_with_case_ignore(header, prefix)) { return false; }
+
+    // Skip whitespace after "Content-Disposition:"
+    auto pos = prefix_len;
+    while (pos < header.size() && (header[pos] == ' ' || header[pos] == '\t')) {
+      pos++;
+    }
+
+    // Match "form-data;" (case-insensitive)
+    constexpr const char form_data[] = "form-data;";
+    constexpr size_t form_data_len = str_len(form_data);
+    if (!start_with_case_ignore(header, form_data, pos)) { return false; }
+    pos += form_data_len;
+
+    // Skip whitespace after "form-data;"
+    while (pos < header.size() && (header[pos] == ' ' || header[pos] == '\t')) {
+      pos++;
+    }
+
+    params_out = header.substr(pos);
+    return true;
+  }
+
   const std::string dash_ = "--";
   const std::string crlf_ = "\r\n";
   std::string boundary_;
@@ -8148,7 +8243,8 @@ get_range_offset_and_length(Range r, size_t content_length) {
   assert(r.first <= r.second &&
          r.second < static_cast<ssize_t>(content_length));
   (void)(content_length);
-  return std::make_pair(r.first, static_cast<size_t>(r.second - r.first) + 1);
+  return std::make_pair(static_cast<size_t>(r.first),
+                        static_cast<size_t>(r.second - r.first) + 1);
 }
 
 inline std::string make_content_range_header_field(
@@ -8741,9 +8837,10 @@ inline bool match_hostname(const std::string &pattern,
 // Verify certificate using Windows CertGetCertificateChain API.
 // This provides real-time certificate validation with Windows Update
 // integration, independent of the TLS backend (OpenSSL or MbedTLS).
-inline bool verify_cert_with_windows_schannel(
-    const std::vector<unsigned char> &der_cert, const std::string &hostname,
-    bool verify_hostname, unsigned long &out_error) {
+inline bool
+verify_cert_with_windows_schannel(const std::vector<unsigned char> &der_cert,
+                                  const std::string &hostname,
+                                  bool verify_hostname, uint64_t &out_error) {
   if (der_cert.empty()) { return false; }
 
   out_error = 0;
@@ -9404,7 +9501,7 @@ inline size_t Request::get_param_value_count(const std::string &key) const {
 
 inline bool Request::is_multipart_form_data() const {
   const auto &content_type = get_header_value("Content-Type");
-  return !content_type.rfind("multipart/form-data", 0);
+  return detail::extract_media_type(content_type) == "multipart/form-data";
 }
 
 // Multipart FormData implementation
@@ -10886,7 +10983,8 @@ inline bool Server::read_content(Stream &strm, Request &req, Response &res) {
             return true;
           })) {
     const auto &content_type = req.get_header_value("Content-Type");
-    if (!content_type.find("application/x-www-form-urlencoded")) {
+    if (detail::extract_media_type(content_type) ==
+        "application/x-www-form-urlencoded") {
       if (req.body.size() > CPPHTTPLIB_FORM_URL_ENCODED_PAYLOAD_MAX_LENGTH) {
         res.status = StatusCode::PayloadTooLarge_413; // NOTE: should be 414?
         output_error_log(Error::ExceedMaxPayloadSize, &req);
@@ -11243,6 +11341,10 @@ inline bool Server::listen_internal() {
       detail::set_socket_opt_time(sock, SOL_SOCKET, SO_SNDTIMEO,
                                   write_timeout_sec_, write_timeout_usec_);
 
+      if (tcp_nodelay_) {
+        detail::set_socket_opt(sock, IPPROTO_TCP, TCP_NODELAY, 1);
+      }
+
       if (!task_queue->enqueue(
               [this, sock]() { process_and_close_socket(sock); })) {
         output_error_log(Error::ResourceExhaustion, nullptr);
@@ -11273,45 +11375,63 @@ inline bool Server::routing(Request &req, Response &res, Stream &strm) {
   if (detail::expect_content(req)) {
     // Content reader handler
     {
+      // Track whether the ContentReader was aborted due to the decompressed
+      // payload exceeding `payload_max_length_`.
+      // The user handler runs after the lambda returns, so we must restore the
+      // 413 status if the handler overwrites it.
+      bool content_reader_payload_too_large = false;
+
       ContentReader reader(
           [&](ContentReceiver receiver) {
             auto result = read_content_with_content_receiver(
                 strm, req, res, std::move(receiver), nullptr, nullptr);
-            if (!result) { output_error_log(Error::Read, &req); }
+            if (!result) {
+              output_error_log(Error::Read, &req);
+              if (res.status == StatusCode::PayloadTooLarge_413) {
+                content_reader_payload_too_large = true;
+              }
+            }
             return result;
           },
           [&](FormDataHeader header, ContentReceiver receiver) {
             auto result = read_content_with_content_receiver(
                 strm, req, res, nullptr, std::move(header),
                 std::move(receiver));
-            if (!result) { output_error_log(Error::Read, &req); }
+            if (!result) {
+              output_error_log(Error::Read, &req);
+              if (res.status == StatusCode::PayloadTooLarge_413) {
+                content_reader_payload_too_large = true;
+              }
+            }
             return result;
           });
 
+      bool dispatched = false;
       if (req.method == "POST") {
-        if (dispatch_request_for_content_reader(
-                req, res, std::move(reader),
-                post_handlers_for_content_reader_)) {
-          return true;
-        }
+        dispatched = dispatch_request_for_content_reader(
+            req, res, std::move(reader), post_handlers_for_content_reader_);
       } else if (req.method == "PUT") {
-        if (dispatch_request_for_content_reader(
-                req, res, std::move(reader),
-                put_handlers_for_content_reader_)) {
-          return true;
-        }
+        dispatched = dispatch_request_for_content_reader(
+            req, res, std::move(reader), put_handlers_for_content_reader_);
       } else if (req.method == "PATCH") {
-        if (dispatch_request_for_content_reader(
-                req, res, std::move(reader),
-                patch_handlers_for_content_reader_)) {
-          return true;
-        }
+        dispatched = dispatch_request_for_content_reader(
+            req, res, std::move(reader), patch_handlers_for_content_reader_);
       } else if (req.method == "DELETE") {
-        if (dispatch_request_for_content_reader(
-                req, res, std::move(reader),
-                delete_handlers_for_content_reader_)) {
-          return true;
+        dispatched = dispatch_request_for_content_reader(
+            req, res, std::move(reader), delete_handlers_for_content_reader_);
+      }
+
+      if (dispatched) {
+        if (content_reader_payload_too_large) {
+          // Enforce the limit: override any status the handler may have set
+          // and return false so the error path sends a plain 413 response.
+          res.status = StatusCode::PayloadTooLarge_413;
+          res.body.clear();
+          res.content_length_ = 0;
+          res.content_provider_ = nullptr;
+          return false;
         }
+        return true;
       }
     }
 
@@ -11717,23 +11837,13 @@ Server::process_request(Stream &strm, const std::string &remote_addr,
 #else
   try {
     routed = routing(req, res, strm);
-  } catch (std::exception &e) {
+  } catch (std::exception &) {
     if (exception_handler_) {
       auto ep = std::current_exception();
       exception_handler_(req, res, ep);
       routed = true;
     } else {
       res.status = StatusCode::InternalServerError_500;
-      std::string val;
-      auto s = e.what();
-      for (size_t i = 0; s[i]; i++) {
-        switch (s[i]) {
-        case '\r': val += "\\r"; break;
-        case '\n': val += "\\n"; break;
-        default: val += s[i]; break;
-        }
-      }
-      res.set_header("EXCEPTION_WHAT", val);
     }
   } catch (...) {
     if (exception_handler_) {
@@ -11742,7 +11852,6 @@ Server::process_request(Stream &strm, const std::string &remote_addr,
       routed = true;
     } else {
       res.status = StatusCode::InternalServerError_500;
-      res.set_header("EXCEPTION_WHAT", "UNKNOWN");
     }
   }
 #endif
@@ -12331,11 +12440,17 @@ ClientImpl::open_stream(const std::string &method, const std::string &path,
   handle.body_reader_.stream = handle.stream_;
   handle.body_reader_.payload_max_length = payload_max_length_;
 
-  auto content_length_str = handle.response->get_header_value("Content-Length");
-  if (!content_length_str.empty()) {
+  if (handle.response->has_header("Content-Length")) {
+    bool is_invalid = false;
+    auto content_length = detail::get_header_value_u64(
+        handle.response->headers, "Content-Length", 0, 0, is_invalid);
+    if (is_invalid) {
+      handle.error = Error::Read;
+      handle.response.reset();
+      return handle;
+    }
     handle.body_reader_.has_content_length = true;
-    handle.body_reader_.content_length =
-        static_cast<size_t>(std::stoull(content_length_str));
+    handle.body_reader_.content_length = content_length;
   }
 
   auto transfer_encoding =
@@ -12619,7 +12734,7 @@ inline bool ClientImpl::redirect(Request &req, Response &res, Error &error) {
 
   auto next_port = port_;
   if (!port_str.empty()) {
-    next_port = std::stoi(port_str);
+    if (!detail::parse_port(port_str, next_port)) { return false; }
   } else if (!next_scheme.empty()) {
     next_port = next_scheme == "https" ? 443 : 80;
   }
@@ -12670,18 +12785,10 @@ inline bool ClientImpl::create_redirect_client(
     // Setup basic client configuration first
     setup_redirect_client(redirect_client);
 
-    // SSL-specific configuration for proxy environments
-    if (!proxy_host_.empty() && proxy_port_ != -1) {
-      // Critical: Disable SSL verification for proxy environments
-      redirect_client.enable_server_certificate_verification(false);
-      redirect_client.enable_server_hostname_verification(false);
-    } else {
-      // For direct SSL connections, copy SSL verification settings
-      redirect_client.enable_server_certificate_verification(
-          server_certificate_verification_);
-      redirect_client.enable_server_hostname_verification(
-          server_hostname_verification_);
-    }
+    redirect_client.enable_server_certificate_verification(
+        server_certificate_verification_);
+    redirect_client.enable_server_hostname_verification(
+        server_hostname_verification_);
 
     // Transfer CA certificate to redirect client
     if (!ca_cert_pem_.empty()) {
@@ -14398,7 +14505,8 @@ inline Client::Client(const std::string &scheme_host_port,
     if (host.empty()) { host = m[3].str(); }
 
     auto port_str = m[4].str();
-    auto port = !port_str.empty() ? std::stoi(port_str) : (is_ssl ? 443 : 80);
+    auto port = is_ssl ? 443 : 80;
+    if (!port_str.empty() && !detail::parse_port(port_str, port)) { return; }
 
     if (is_ssl) {
 #ifdef CPPHTTPLIB_SSL_ENABLED
@@ -15423,8 +15531,7 @@ inline void SSLClient::set_session_verifier(
   session_verifier_ = std::move(verifier);
 }
 
-#if defined(_WIN32) &&                                                         \
-    !defined(CPPHTTPLIB_DISABLE_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE)
+#ifdef CPPHTTPLIB_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE
 inline void SSLClient::enable_windows_certificate_verification(bool enabled) {
   enable_windows_cert_verification_ = enabled;
 }
@@ -15553,7 +15660,7 @@ inline bool SSLClient::initialize_ssl(Socket &socket, Error &error) {
       server_certificate_verification_) {
     verify_result_ = tls::get_verify_result(session);
     if (verify_result_ != 0) {
-      last_backend_error_ = static_cast<unsigned long>(verify_result_);
+      last_backend_error_ = static_cast<uint64_t>(verify_result_);
       error = Error::SSLServerVerification;
       output_error_log(error, nullptr);
       return false;
@@ -15582,8 +15689,7 @@ inline bool SSLClient::initialize_ssl(Socket &socket, Error &error) {
       }
     }
 
-#if defined(_WIN32) &&                                                         \
-    !defined(CPPHTTPLIB_DISABLE_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE)
+#ifdef CPPHTTPLIB_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE
     // Additional Windows Schannel verification.
     // This provides real-time certificate validation with Windows Update
     // integration, working with both OpenSSL and MbedTLS backends.
@@ -15593,7 +15699,7 @@ inline bool SSLClient::initialize_ssl(Socket &socket, Error &error) {
         ca_cert_dir_path_.empty() && ca_cert_pem_.empty()) {
       std::vector<unsigned char> der;
       if (get_cert_der(server_cert, der)) {
-        unsigned long wincrypt_error = 0;
+        uint64_t wincrypt_error = 0;
         if (!detail::verify_cert_with_windows_schannel(
                 der, host_, server_hostname_verification_, wincrypt_error)) {
           last_backend_error_ = wincrypt_error;
@@ -15629,8 +15735,7 @@ inline void Client::enable_server_hostname_verification(bool enabled) {
   cli_->enable_server_hostname_verification(enabled);
 }
 
-#if defined(_WIN32) &&                                                         \
-    !defined(CPPHTTPLIB_DISABLE_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE)
+#ifdef CPPHTTPLIB_WINDOWS_AUTOMATIC_ROOT_CERTIFICATES_UPDATE
 inline void Client::enable_windows_certificate_verification(bool enabled) {
   if (is_ssl_) {
     static_cast<SSLClient &>(*cli_).enable_windows_certificate_verification(
@@ -15718,16 +15823,26 @@ inline bool is_ipv4_address(const std::string &str) {
 
 // Parse IPv4 address string to bytes
 inline bool parse_ipv4(const std::string &str, unsigned char *out) {
-  int parts[4];
-  if (sscanf(str.c_str(), "%d.%d.%d.%d", &parts[0], &parts[1], &parts[2],
-             &parts[3]) != 4) {
-    return false;
-  }
+  const char *p = str.c_str();
   for (int i = 0; i < 4; i++) {
-    if (parts[i] < 0 || parts[i] > 255) return false;
-    out[i] = static_cast<unsigned char>(parts[i]);
+    if (i > 0) {
+      if (*p != '.') { return false; }
+      p++;
+    }
+    int val = 0;
+    int digits = 0;
+    while (*p >= '0' && *p <= '9') {
+      val = val * 10 + (*p - '0');
+      if (val > 255) { return false; }
+      p++;
+      digits++;
+    }
+    if (digits == 0) { return false; }
+    // Reject leading zeros (e.g., "01.002.03.04") to prevent ambiguity
+    if (digits > 1 && *(p - digits) == '0') { return false; }
+    out[i] = static_cast<unsigned char>(val);
   }
-  return true;
+  return *p == '\0';
 }
 
 #ifdef _WIN32
@@ -15753,7 +15868,7 @@ inline bool enumerate_windows_system_certs(Callback cb) {
 }
 #endif
 
-#if defined(__APPLE__) && defined(CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN)
+#ifdef CPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN
 // Enumerate macOS Keychain certificates and call callback with DER data
 template <typename Callback>
 inline bool enumerate_macos_keychain_certs(Callback cb) {
@@ -17029,11 +17144,11 @@ inline void update_server_certs_from_x509(ctx_t ctx, X509 *cert, EVP_PKEY *key,
 
 inline ctx_t create_client_context_from_x509(X509 *cert, EVP_PKEY *key,
                                              const char *password,
-                                             unsigned long &out_error) {
+                                             uint64_t &out_error) {
   out_error = 0;
   auto ctx = create_client_context();
   if (!ctx) {
-    out_error = static_cast<unsigned long>(get_error());
+    out_error = get_error();
     return nullptr;
   }
 
@@ -17047,7 +17162,7 @@ inline ctx_t create_client_context_from_x509(X509 *cert, EVP_PKEY *key,
     }
     if (!set_client_cert_pem(ctx, cert_pem.c_str(), key_pem.c_str(),
                              password)) {
-      out_error = static_cast<unsigned long>(get_error());
+      out_error = get_error();
       free_context(ctx);
       return nullptr;
     }
@@ -19804,7 +19919,8 @@ inline WebSocketClient::WebSocketClient(
     if (host_.empty()) { host_ = m[3].str(); }
 
     auto port_str = m[4].str();
-    port_ = !port_str.empty() ? std::stoi(port_str) : (is_ssl ? 443 : 80);
+    port_ = is_ssl ? 443 : 80;
+    if (!port_str.empty() && !detail::parse_port(port_str, port_)) { return; }
 
     path_ = m[5].str();
 

justfile

@@ -44,3 +44,12 @@ build:
 
 bench:
     @(cd benchmark && make bench-all)
+
+docs:
+    @cargo build --release --manifest-path docs-gen/Cargo.toml
+    @./docs-gen/target/release/docs-gen build docs-src --out docs
+
+docs-serve:
+    @cargo build --release --manifest-path docs-gen/Cargo.toml
+    -@./docs-gen/target/release/docs-gen serve docs-src --open
+

meson.build

@@ -62,11 +62,13 @@ if get_option('tls').allowed()
   endif
 
   if tls_found and host_machine.system() == 'darwin'
-    macosx_keychain_dep = dependency('appleframeworks', modules: ['CFNetwork', 'CoreFoundation', 'Security'], required: get_option('macosx_keychain'))
-    if macosx_keychain_dep.found()
+    disable_macosx_certs = get_option('disable_macosx_automatic_root_certificates')
+    if disable_macosx_certs
+        args += '-DCPPHTTPLIB_DISABLE_MACOSX_AUTOMATIC_ROOT_CERTIFICATES'
+    else
+        macosx_keychain_dep = dependency('appleframeworks', modules: ['CFNetwork', 'CoreFoundation', 'Security'], required: true)
         deps += macosx_keychain_dep
-        args += '-DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN'
-    endif  
+    endif
   endif
 endif
 

meson_options.txt

@@ -7,7 +7,7 @@ option('tls_backend', type: 'combo', choices: ['openssl', 'mbedtls'], value: 'op
 option('zlib',    type: 'feature', value: 'auto', description: 'Enable zlib support')
 option('brotli',  type: 'feature', value: 'auto', description: 'Enable Brotli support')
 option('zstd',    type: 'feature', value: 'auto', description: 'Enable zstd support')
-option('macosx_keychain', type: 'feature', value: 'auto', description: 'Enable loading certs from the Keychain on Apple devices')
+option('disable_macosx_automatic_root_certificates', type: 'boolean', value: false, description: 'Disable loading system certs from the Apple Keychain on macOS')
 option('non_blocking_getaddrinfo', type: 'feature', value: 'auto', description: 'Enable asynchronous name lookup')
 option('compile', type: 'boolean', value: false,  description: 'Split the header into a compilable header & source file (requires python3)')
 option('test',    type: 'boolean', value: false,  description: 'Build tests')
@@ -17,6 +17,7 @@ option('openssl', type: 'feature', deprecated: 'tls')
 option('cpp-httplib_openssl', type: 'feature', deprecated: 'openssl')
 option('cpp-httplib_zlib',    type: 'feature', deprecated: 'zlib')
 option('cpp-httplib_brotli',  type: 'feature', deprecated: 'brotli')
+option('macosx_keychain', type: 'feature', deprecated: true, description: 'Deprecated: use disable_macosx_automatic_root_certificates instead')
 option('cpp-httplib_macosx_keychain', type: 'feature', deprecated: 'macosx_keychain')
 option('cpp-httplib_non_blocking_getaddrinfo', type: 'feature', deprecated: 'non_blocking_getaddrinfo')
 option('cpp-httplib_compile', type: 'boolean', value: false, deprecated: 'compile')

test/Makefile

@@ -7,13 +7,13 @@ ifneq ($(OS), Windows_NT)
 		PREFIX ?= $(shell brew --prefix)
 		OPENSSL_DIR = $(PREFIX)/opt/openssl@3
 		OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -I$(OPENSSL_DIR)/include -L$(OPENSSL_DIR)/lib -lssl -lcrypto
-		OPENSSL_SUPPORT += -DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN -framework Security
+		OPENSSL_SUPPORT += -framework CoreFoundation -framework Security
 		MBEDTLS_DIR ?= $(shell brew --prefix mbedtls@3)
 		MBEDTLS_SUPPORT = -DCPPHTTPLIB_MBEDTLS_SUPPORT -I$(MBEDTLS_DIR)/include -L$(MBEDTLS_DIR)/lib -lmbedtls -lmbedx509 -lmbedcrypto
-		MBEDTLS_SUPPORT += -DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN -framework Security
+		MBEDTLS_SUPPORT += -framework CoreFoundation -framework Security
 		WOLFSSL_DIR ?= $(shell brew --prefix wolfssl)
 		WOLFSSL_SUPPORT = -DCPPHTTPLIB_WOLFSSL_SUPPORT -I$(WOLFSSL_DIR)/include -I$(WOLFSSL_DIR)/include/wolfssl -L$(WOLFSSL_DIR)/lib -lwolfssl
-		WOLFSSL_SUPPORT += -DCPPHTTPLIB_USE_CERTS_FROM_MACOSX_KEYCHAIN -framework Security
+		WOLFSSL_SUPPORT += -framework CoreFoundation -framework Security
 	else
 		OPENSSL_SUPPORT = -DCPPHTTPLIB_OPENSSL_SUPPORT -lssl -lcrypto
 		MBEDTLS_SUPPORT = -DCPPHTTPLIB_MBEDTLS_SUPPORT -lmbedtls -lmbedx509 -lmbedcrypto
@@ -254,5 +254,5 @@ cert.pem:
 	./gen-certs.sh
 
 clean:
-	rm -rf test test_split test_mbedtls test_split_mbedtls test_wolfssl test_split_wolfssl test_no_tls, test_split_no_tls test_proxy test_proxy_mbedtls test_proxy_wolfssl server_fuzzer *.pem *.0 *.o *.1 *.srl httplib.h httplib.cc _build* *.dSYM *_shard_*.log
+	rm -rf test test_split test_mbedtls test_split_mbedtls test_wolfssl test_split_wolfssl test_no_tls, test_split_no_tls test_proxy test_proxy_mbedtls test_proxy_wolfssl server_fuzzer *.pem *.0 *.o *.1 *.srl httplib.h httplib.cc _build* *.dSYM *_shard_*.log cpp-httplib
 

test/proxy/basic_squid.conf

@@ -15,6 +15,7 @@ acl localnet src fc00::/7       	# RFC 4193 local private network range
 acl localnet src fe80::/10      	# RFC 4291 link-local (directly plugged) machines
 
 acl SSL_ports port 443
+acl SSL_ports port 1025-65535
 acl Safe_ports port 80		# http
 acl Safe_ports port 21		# ftp
 acl Safe_ports port 443		# https

test/proxy/digest_squid.conf

@@ -15,6 +15,7 @@ acl localnet src fc00::/7       	# RFC 4193 local private network range
 acl localnet src fe80::/10      	# RFC 4291 link-local (directly plugged) machines
 
 acl SSL_ports port 443
+acl SSL_ports port 1025-65535
 acl Safe_ports port 80		# http
 acl Safe_ports port 21		# ftp
 acl Safe_ports port 443		# https

test/proxy/docker-compose.ci.yml

@@ -0,0 +1,8 @@
+services:
+  squid_basic:
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+
+  squid_digest:
+    extra_hosts:
+      - "host.docker.internal:host-gateway"

test/test.cc

@@ -2330,6 +2330,31 @@ TEST(RedirectToDifferentPort, Redirect) {
   EXPECT_EQ("Hello World!", res->body);
 }
 
+TEST(RedirectToDifferentPort, OverflowPortNumber) {
+  Server svr;
+  svr.Get("/redir", [&](const Request & /*req*/, Response &res) {
+    // Port number that overflows int — should not crash
+    res.set_redirect("http://localhost:99999999999999999999/target");
+  });
+
+  auto port = svr.bind_to_any_port(HOST);
+  auto thread = std::thread([&]() { svr.listen_after_bind(); });
+  auto se = detail::scope_exit([&] {
+    svr.stop();
+    thread.join();
+    ASSERT_FALSE(svr.is_running());
+  });
+
+  svr.wait_until_ready();
+
+  Client cli(HOST, port);
+  cli.set_follow_location(true);
+
+  auto res = cli.Get("/redir");
+  // Should fail gracefully, not crash (no valid response due to bad port)
+  EXPECT_FALSE(res);
+}
+
 TEST(RedirectFromPageWithContent, Redirect) {
   Server svr;
 
@@ -2701,16 +2726,14 @@ TEST(ExceptionTest, WithoutExceptionHandler) {
     auto res = cli.Get("/exception");
     ASSERT_TRUE(res);
     EXPECT_EQ(StatusCode::InternalServerError_500, res->status);
-    ASSERT_TRUE(res->has_header("EXCEPTION_WHAT"));
-    EXPECT_EQ("exception...", res->get_header_value("EXCEPTION_WHAT"));
+    EXPECT_FALSE(res->has_header("EXCEPTION_WHAT"));
   }
 
   {
     auto res = cli.Get("/unknown");
     ASSERT_TRUE(res);
     EXPECT_EQ(StatusCode::InternalServerError_500, res->status);
-    ASSERT_TRUE(res->has_header("EXCEPTION_WHAT"));
-    EXPECT_EQ("exception\\r\\n...", res->get_header_value("EXCEPTION_WHAT"));
+    EXPECT_FALSE(res->has_header("EXCEPTION_WHAT"));
   }
 }
 
@@ -3889,6 +3912,13 @@ protected:
                    "01234567890123456789012345678901234567890",
                    "text/plain");
              })
+        .Get("/compress-with-charset",
+             [&](const Request & /*req*/, Response &res) {
+               res.set_content(
+                   "12345678901234567890123456789012345678901234567890123456789"
+                   "01234567890123456789012345678901234567890",
+                   "application/json; charset=utf-8");
+             })
         .Get("/nocompress",
              [&](const Request & /*req*/, Response &res) {
                res.set_content(
@@ -6249,6 +6279,21 @@ TEST_F(ServerTest, Gzip) {
   EXPECT_EQ(StatusCode::OK_200, res->status);
 }
 
+TEST_F(ServerTest, GzipWithContentTypeParameters) {
+  Headers headers;
+  headers.emplace("Accept-Encoding", "gzip, deflate");
+  auto res = cli_.Get("/compress-with-charset", headers);
+
+  ASSERT_TRUE(res);
+  EXPECT_EQ("gzip", res->get_header_value("Content-Encoding"));
+  EXPECT_EQ("application/json; charset=utf-8",
+            res->get_header_value("Content-Type"));
+  EXPECT_EQ("123456789012345678901234567890123456789012345678901234567890123456"
+            "7890123456789012345678901234567890",
+            res->body);
+  EXPECT_EQ(StatusCode::OK_200, res->status);
+}
+
 TEST_F(ServerTest, GzipWithoutAcceptEncoding) {
   Headers headers;
   headers.emplace("Accept-Encoding", "");
@@ -8651,6 +8696,68 @@ TEST_F(LargePayloadMaxLengthTest, NoContentLengthExceeds10MB) {
   }
 }
 
+#ifdef CPPHTTPLIB_ZLIB_SUPPORT
+// `payload_max_length` is not enforced on decompressed body in ContentReader
+// path.
+TEST(PayloadLimitBypassTest, StreamingGzipDecompression) {
+  Server svr;
+  const size_t LIMIT = 64 * 1024; // 64KB
+  svr.set_payload_max_length(LIMIT);
+
+  size_t total = 0;
+  svr.Post("/stream", [&](const Request & /*req*/, Response &res,
+                          const ContentReader &content_reader) {
+    content_reader([&](const char * /*data*/, size_t len) {
+      total += len;
+      return true;
+    });
+    res.status = 200;
+    res.set_content("stream_ok", "text/plain");
+  });
+
+  auto thread = std::thread([&]() { svr.listen(HOST, PORT); });
+  auto se = detail::scope_exit([&] {
+    svr.stop();
+    thread.join();
+    ASSERT_FALSE(svr.is_running());
+  });
+  svr.wait_until_ready();
+
+  // Prepare 256KB raw data and gzip-compress it
+  std::string raw(256 * 1024, 'A');
+  std::string gz;
+  {
+    z_stream zs{};
+    deflateInit2(&zs, Z_BEST_COMPRESSION, Z_DEFLATED, 15 + 16, 8,
+                 Z_DEFAULT_STRATEGY);
+    zs.next_in = reinterpret_cast<Bytef *>(const_cast<char *>(raw.data()));
+    zs.avail_in = static_cast<uInt>(raw.size());
+    char outbuf[4096];
+    int ret;
+    do {
+      zs.next_out = reinterpret_cast<Bytef *>(outbuf);
+      zs.avail_out = sizeof(outbuf);
+      ret = deflate(&zs, Z_FINISH);
+      gz.append(outbuf, sizeof(outbuf) - zs.avail_out);
+    } while (ret != Z_STREAM_END);
+    deflateEnd(&zs);
+  }
+
+  Client cli(HOST, PORT);
+  cli.set_connection_timeout(std::chrono::seconds(5));
+  Headers headers = {{"Content-Encoding", "gzip"}};
+  auto res = cli.Post("/stream", headers, gz.data(), gz.size(),
+                      "application/octet-stream");
+  ASSERT_TRUE(res);
+
+  // Server must reject oversized decompressed payloads with 413.
+  EXPECT_EQ(StatusCode::PayloadTooLarge_413, res->status);
+
+  // Decompressed bytes delivered to the handler must not exceed LIMIT.
+  EXPECT_LE(total, LIMIT);
+}
+#endif
+
 // Regression test for DoS vulnerability: a malicious server sending a response
 // without Content-Length header must not cause unbounded memory consumption on
 // the client side. The client should stop reading after a reasonable limit,
@@ -9359,6 +9466,18 @@ TEST(HostAndPortPropertiesTest, NoSSLWithSimpleAPI) {
   ASSERT_EQ(1234, cli.port());
 }
 
+TEST(HostAndPortPropertiesTest, OverflowPortNumber) {
+  // Port number that overflows int — should not crash, client becomes invalid
+  httplib::Client cli("http://www.google.com:99999999999999999999");
+  ASSERT_FALSE(cli.is_valid());
+}
+
+TEST(HostAndPortPropertiesTest, PortOutOfRange) {
+  // Port 99999 exceeds valid range (1-65535) — should not crash
+  httplib::Client cli("http://www.google.com:99999");
+  ASSERT_FALSE(cli.is_valid());
+}
+
 #ifdef CPPHTTPLIB_SSL_ENABLED
 TEST(HostAndPortPropertiesTest, SSL) {
   httplib::SSLClient cli("www.google.com");
@@ -11527,6 +11646,55 @@ TEST(MultipartFormDataTest, AlternateFilename) {
   ASSERT_TRUE(send_request(1, req));
 }
 
+TEST(MultipartFormDataTest, AlternateFilenameLongValueAndCaseInsensitive) {
+  auto handled = false;
+
+  Server svr;
+  svr.Post("/test", [&](const Request &req, Response &res) {
+    // Case-insensitive "utf-8''" prefix with a long value
+    const auto &file = req.form.get_file("file1");
+    ASSERT_EQ("file1", file.name);
+    // 8000 chars exercises both the Content-Disposition parser and the
+    // filename* parser near the CPPHTTPLIB_HEADER_MAX_LENGTH limit (8192).
+    // Prior to the fix, std::regex_match on this header would cause O(N)
+    // stack recursion in libstdc++, leading to SIGSEGV.
+    std::string expected_filename(8000, 'A');
+    ASSERT_EQ(expected_filename, file.filename);
+
+    res.set_content("ok", "text/plain");
+    handled = true;
+  });
+
+  thread t = thread([&] { svr.listen(HOST, PORT); });
+  auto se = detail::scope_exit([&] {
+    svr.stop();
+    t.join();
+    ASSERT_FALSE(svr.is_running());
+    ASSERT_TRUE(handled);
+  });
+
+  svr.wait_until_ready();
+
+  // Build body with a long filename* value using mixed-case prefix "Utf-8''"
+  // Regression test for GHSA-qq6v-r583-3h69
+  std::string long_filename(8000, 'A');
+  std::string body = "----------\r\n"
+                     "Content-Disposition: form-data; name=\"file1\"; "
+                     "filename*=\"Utf-8''" +
+                     long_filename +
+                     "\"\r\n"
+                     "\r\n"
+                     "hello\r\n"
+                     "------------\r\n";
+
+  auto req = "POST /test HTTP/1.1\r\n"
+             "Content-Type: multipart/form-data;boundary=--------\r\n"
+             "Content-Length: " +
+             std::to_string(body.size()) + "\r\n\r\n" + body;
+
+  ASSERT_TRUE(send_request(1, req));
+}
+
 TEST(MultipartFormDataTest, CloseDelimiterWithoutCRLF) {
   auto handled = false;
 
@@ -12920,6 +13088,66 @@ TEST(ClientInThreadTest, Issue2068) {
   }
 }
 
+TEST(RequestSmugglingTest, DuplicateContentLengthDifferentValues) {
+  auto handled = false;
+
+  Server svr;
+  svr.Post("/test", [&](const Request &, Response &) { handled = true; });
+
+  thread t = thread([&]() { svr.listen(HOST, PORT); });
+  auto se = detail::scope_exit([&] {
+    svr.stop();
+    t.join();
+    ASSERT_FALSE(svr.is_running());
+    ASSERT_FALSE(handled);
+  });
+
+  svr.wait_until_ready();
+
+  // Two Content-Length headers with different values — must be rejected
+  auto req = "POST /test HTTP/1.1\r\n"
+             "Content-Length: 5\r\n"
+             "Content-Length: 10\r\n"
+             "\r\n"
+             "hello";
+
+  std::string response;
+  ASSERT_TRUE(send_request(1, req, &response));
+  ASSERT_EQ("HTTP/1.1 400 Bad Request",
+            response.substr(0, response.find("\r\n")));
+}
+
+TEST(RequestSmugglingTest, DuplicateContentLengthSameValues) {
+  auto handled = false;
+
+  Server svr;
+  svr.Post("/test", [&](const Request &, Response &res) {
+    handled = true;
+    res.set_content("ok", "text/plain");
+  });
+
+  thread t = thread([&]() { svr.listen(HOST, PORT); });
+  auto se = detail::scope_exit([&] {
+    svr.stop();
+    t.join();
+    ASSERT_FALSE(svr.is_running());
+    ASSERT_TRUE(handled);
+  });
+
+  svr.wait_until_ready();
+
+  // Two Content-Length headers with same value — should be accepted (RFC 9110)
+  auto req = "POST /test HTTP/1.1\r\n"
+             "Content-Length: 5\r\n"
+             "Content-Length: 5\r\n"
+             "\r\n"
+             "hello";
+
+  std::string response;
+  ASSERT_TRUE(send_request(1, req, &response));
+  ASSERT_EQ("HTTP/1.1 200 OK", response.substr(0, response.find("\r\n")));
+}
+
 TEST(HeaderSmugglingTest, ChunkedTrailerHeadersMerged) {
   Server svr;
 
@@ -13581,6 +13809,102 @@ TEST_F(OpenStreamTest, ProhibitedTrailersAreIgnored_Stream) {
   EXPECT_EQ(std::string(""), handle.response->get_header_value("X-Allowed"));
 }
 
+static std::thread serve_single_response(int port,
+                                         const std::string &response) {
+  return std::thread([port, response] {
+    auto srv = ::socket(AF_INET, SOCK_STREAM, 0);
+    default_socket_options(srv);
+    detail::set_socket_opt_time(srv, SOL_SOCKET, SO_RCVTIMEO, 5, 0);
+    detail::set_socket_opt_time(srv, SOL_SOCKET, SO_SNDTIMEO, 5, 0);
+
+    sockaddr_in addr{};
+    addr.sin_family = AF_INET;
+    addr.sin_port = htons(static_cast<uint16_t>(port));
+    ::inet_pton(AF_INET, "127.0.0.1", &addr.sin_addr);
+
+    int opt = 1;
+    ::setsockopt(srv, SOL_SOCKET, SO_REUSEADDR,
+#ifdef _WIN32
+                 reinterpret_cast<const char *>(&opt),
+#else
+                 &opt,
+#endif
+                 sizeof(opt));
+
+    ::bind(srv, reinterpret_cast<sockaddr *>(&addr), sizeof(addr));
+    ::listen(srv, 1);
+
+    sockaddr_in cli_addr{};
+    socklen_t cli_len = sizeof(cli_addr);
+    auto cli = ::accept(srv, reinterpret_cast<sockaddr *>(&cli_addr), &cli_len);
+
+    if (cli != INVALID_SOCKET) {
+      char buf[4096];
+      ::recv(cli, buf, sizeof(buf), 0);
+
+      ::send(cli,
+#ifdef _WIN32
+             static_cast<const char *>(response.c_str()),
+             static_cast<int>(response.size()),
+#else
+             response.c_str(), response.size(),
+#endif
+             0);
+
+      detail::close_socket(cli);
+    }
+    detail::close_socket(srv);
+  });
+}
+
+TEST(OpenStreamMalformedContentLength, InvalidArgument) {
+#ifndef _WIN32
+  signal(SIGPIPE, SIG_IGN);
+#endif
+
+  auto server_thread =
+      serve_single_response(PORT + 2, "HTTP/1.1 200 OK\r\n"
+                                      "Content-Type: text/plain\r\n"
+                                      "Content-Length: not-a-number\r\n"
+                                      "Connection: close\r\n"
+                                      "\r\n"
+                                      "hello");
+
+  std::this_thread::sleep_for(std::chrono::milliseconds(200));
+
+  Client cli("127.0.0.1", PORT + 2);
+  auto handle = cli.open_stream("GET", "/");
+  EXPECT_FALSE(handle.is_valid());
+
+  server_thread.join();
+}
+
+TEST(OpenStreamMalformedContentLength, OutOfRange) {
+#ifndef _WIN32
+  signal(SIGPIPE, SIG_IGN);
+#endif
+
+  auto server_thread = serve_single_response(
+      PORT + 2, "HTTP/1.1 200 OK\r\n"
+                "Content-Type: text/plain\r\n"
+                "Content-Length: 99999999999999999999999999\r\n"
+                "Connection: close\r\n"
+                "\r\n"
+                "hello");
+
+  std::this_thread::sleep_for(std::chrono::milliseconds(200));
+
+  // Before the fix, std::stoull would throw std::out_of_range here and
+  // crash the process. After the fix, strtoull silently clamps to
+  // ULLONG_MAX so the stream opens without crashing. The important thing
+  // is that the process does NOT terminate.
+  Client cli("127.0.0.1", PORT + 2);
+  auto handle = cli.open_stream("GET", "/");
+  EXPECT_TRUE(handle.is_valid());
+
+  server_thread.join();
+}
+
 #ifdef CPPHTTPLIB_ZLIB_SUPPORT
 TEST_F(OpenStreamTest, Gzip) {
   Client cli("127.0.0.1", port_);
@@ -15660,7 +15984,7 @@ TEST(ZipBombProtectionTest, DecompressedSizeExceedsLimit) {
 
   // Server should reject because decompressed size (8KB) exceeds limit (1KB)
   ASSERT_TRUE(res);
-  EXPECT_EQ(StatusCode::BadRequest_400, res->status);
+  EXPECT_EQ(StatusCode::PayloadTooLarge_413, res->status);
 }
 #endif
 
@@ -16198,6 +16522,14 @@ TEST(WebSocketTest, InvalidURL) {
   // Missing host
   ws::WebSocketClient ws4("ws://:8080/path");
   EXPECT_FALSE(ws4.is_valid());
+
+  // Port number overflow — should not crash
+  ws::WebSocketClient ws5("ws://localhost:99999999999999999999/path");
+  EXPECT_FALSE(ws5.is_valid());
+
+  // Port out of range
+  ws::WebSocketClient ws6("ws://localhost:99999/path");
+  EXPECT_FALSE(ws6.is_valid());
 }
 
 TEST(WebSocketTest, UnsupportedScheme) {

test/test_32bit_build.cpp

@@ -0,0 +1,9 @@
+#include "../httplib.h"
+
+int main() {
+  httplib::Server svr;
+  httplib::Client cli("localhost", 8080);
+  (void)svr;
+  (void)cli;
+  return 0;
+}

test/test_proxy.cc

@@ -109,6 +109,55 @@ TEST(RedirectTest, YouTubeSSLDigest) {
 
 // ----------------------------------------------------------------------------
 
+#ifdef CPPHTTPLIB_SSL_ENABLED
+TEST(RedirectTest, TLSVerificationOnProxyRedirect) {
+  // Untrusted HTTPS server with self-signed cert
+  SSLServer untrusted_svr("cert.pem", "key.pem");
+  untrusted_svr.Get("/", [](const Request &, Response &res) {
+    res.set_content("MITM'd", "text/plain");
+  });
+
+  auto untrusted_port = untrusted_svr.bind_to_any_port("0.0.0.0");
+  auto t1 = thread([&]() { untrusted_svr.listen_after_bind(); });
+  auto se1 = detail::scope_exit([&] {
+    untrusted_svr.stop();
+    t1.join();
+  });
+
+  // HTTP server that redirects to the untrusted HTTPS server
+  // Use host.docker.internal so the proxy container can reach the host
+  Server redirect_svr;
+  redirect_svr.Get("/", [&](const Request &, Response &res) {
+    res.set_redirect(
+        "https://host.docker.internal:" + to_string(untrusted_port) + "/");
+  });
+
+  auto redirect_port = redirect_svr.bind_to_any_port("0.0.0.0");
+  auto t2 = thread([&]() { redirect_svr.listen_after_bind(); });
+  auto se2 = detail::scope_exit([&] {
+    redirect_svr.stop();
+    t2.join();
+  });
+
+  // Wait until servers are up
+  untrusted_svr.wait_until_ready();
+  redirect_svr.wait_until_ready();
+
+  // Client with proxy + follow_location, verification ON (default)
+  Client cli("host.docker.internal", redirect_port);
+  cli.set_proxy("localhost", 3128);
+  cli.set_proxy_basic_auth("hello", "world");
+  cli.set_follow_location(true);
+
+  auto res = cli.Get("/");
+
+  // Self-signed cert must be rejected
+  ASSERT_TRUE(res == nullptr);
+}
+#endif
+
+// ----------------------------------------------------------------------------
+
 template <typename T> void BaseAuthTestFromHTTPWatch(T &cli) {
   cli.set_proxy("localhost", 3128);
   cli.set_proxy_basic_auth("hello", "world");