11–20 of 160 posts
How about embedding the contents of the HTML files so that no access to the filesystem is required? That would make it not only faster but also safer.
Nice. I've done this in the past. But I feel like attempting to make a file serving http server is like adding preservants and high fructose corn syrup to home made baked goods. You have the opportunity to really make something custom and of high quality, hard code the paths of your files and avoid a whole class of vulnerabilities for example. Configuration files? That makes sense when programmer and sysadmin are dis…
Not sure if serious…
I’m waiting for someone to chime in and explain why that would be a bad idea cause I can’t think of it from a security perspective.
Earlier quoted context omitted.
Not sure if serious…
Not the only time it’s been brought up in this thread: https://news.ycombinator.com/item?id=41643198 I’m waiting for someone to chime in and explain why that would be a bad idea cause I can’t think of it from a security perspective.
vs just putting things in a subfolder of your repo or whatever and having the default handling not accept `..` path components
Only 3.4k of C code for a full http and https server? I honestly thought you would need a lot more for it to be fully compliant with the spec.
It’s fun and not that bad really.
Nice. I've done this in the past. But I feel like attempting to make a file serving http server is like adding preservants and high fructose corn syrup to home made baked goods. You have the opportunity to really make something custom and of high quality, hard code the paths of your files and avoid a whole class of vulnerabilities for example. Configuration files? That makes sense when programmer and sysadmin are dis…
It’s fast!
I have always wanted to try out something like this.
Good job!
Only 3.4k of C code for a full http and https server? I honestly thought you would need a lot more for it to be fully compliant with the spec.
Http/1.1 is dead simple if you ignore most of the spec. If you only take get requests and set content-length on response you will be good for 99% of user agents. It’s not much more code to handle the transfer-encoding and byte-range headers. HTTPS is just http over a tls socket which is the level of abstraction you should have if you don’t roll your own crypto. It’s fun and not that bad really.
Hell if you’re really lazy you can forgo responding with the http headers and just socket.write(“hello world”) as the response and all the major browsers will render “hello world” to the user. Properly formatted http headers are just a text string extra and the html is just text. There’s not much to it.