redbean | HackerShow

Skip to content

Infrastructure

http server

SHOW HN2021

redbean

Micro HTTP server in 22 lines of C

#http server #micro server #c web server #single file server #cosmopolitan

Shown by jpegqs on Jul 31, 2021. Click the card to turn it over.

223points

100comments

#187of 2,533 in 2021

Top 8%of 2021 by points

How HN took it

MixedNo clear lean

5 positive, 12 neutral or asking, 1 mixed, 12 critical, out of 30 comments about the project. Thread score -0.17.

Execution: 0 for, 9 againstPerformance: 2 for, 0 againstIdea: 2 for, 0 againstDesign: 1 for, 1 againstPrivacy: 0 for, 2 against

The thread, comment by comment

Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.

positive neutral or mixed critical about another commenter or something else the maker

What HN said

What people liked

Clever, small, and fun demonstration of simplicity
From 3 comments
- The ASCII-art formatted version is pretty nice looking. I was going to say that I don’t however get why the “almost readable version” is weirdly formatted. But then I ran it…
  codetrotter on HN
- I was surprised to read that this is actually a totally valid HTTP/1.1 application, according to the RFC. The only thing you need is the status line (http version, status code,…
  snet0 on HN
- You seem to have written a glorious series of interlocking hacks which yields a small, tight, simple, fast, portable, useful nugget of functionality in a single file. Bravo. I…
  javajosh on HN

Objections

HTTP parsing is not actually simple; the sample ignores many spec requirements
From 4 comments
- No, parsing HTTP/1.x is a nightmare and definitely not simple. It wasn't even particularly well defined until 2014 when the original RFCs were modernized, and even now there are…
  nly on HN
- HTTP/1.x is anything but simple. They were under defined and overly complex in many ways. The original RFC was so complex that when reworked, they split it into 6 documents. I've…
  darnir on HN
- I agree. As with many things, it's only simple as long as you ignore the complexities. As they say, the devil's in the details. > this "server" only responds to a simple well…
  kevinoid on HN
- HTTP/1 is deceptive, because you think "oh, I'll just read RFC 2616, make a state machine, and I'm done!". But then writing a browser-compatible HTTP/1 client is a whole another…
  pornel on HN
Path traversal and security risks in the server
From 4 comments
- I know this is just for fun and not intended for production use. But what could be potential exploits and vulnerabilities in this server?
  gberger on HN
- GET ../../../etc/passwd
  sneak on HN
- GET %C0%AE%C0%AE/%C0%AE%C0%AE/%C0%AE%C0%AE/etc/passwd
  jart on HN
- GET //etc/passwd HTTP/1.0 I noticed the check for "/." in the path and I chuckled. I think if you strip all leading forward slashes and check for "/." then you may have it be…
  Arch-TK on HN

Requests

Use safer string functions such as strncpy
From 1 comment
- use strncpy() instead of strcpy()
  jijji on HN

Questions

What are potential exploits and vulnerabilities?
From 1 comment
- I know this is just for fun and not intended for production use. But what could be potential exploits and vulnerabilities in this server?
  gberger on HN

Alternatives named

libmicrohttpd
From 1 comment
- Also, if you want to include #include <microhttpd.h> you can write a useful, safe (well tested), http server in a similar number of lines.
  mianos on HN
ultra
From 1 comment
- Reminds me of ultra: https://github.com/MarquisdeGeek/ultra
  alanjay on HN