Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

github.com

Post reply on HN
Print view View original

41–50 of 119 posts

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#41

Post by __jonas »

Sohcahtoa82 wrote: post #40

> SPA_MODE when set to 1 404 request will return /public/index.html as a 200. oof, as someone who frequently has to run DAST tools, returning a 200 for something that should be a 404 is the bane of my existence. The tool will try to request sensitive files by trying something as simple as fetching hxxps://example.com/../../../etc/passwd. If you return a "200 OK", it will flag as a security issue, even if the resultin…

But if it's an SPA, how else would you handle this case?

How is the webserver supposed to know in advance which URLs the SPA is able to handle?

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#42

Post by fabrice_d »

ngrilly wrote: post #23

Considering the latency between the user web browser and the server, does the “extremely low latency on account of caching all files in memory” really matter? The files should already be cached by the OS and using sendfile lets the OS copy the file directly to the network.

https basically makes sendfile unusable for that use case.

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#43

Post by ngrilly »

tempnow987 wrote: post #36
ngrilly wrote: post #23

Considering the latency between the user web browser and the server, does the “extremely low latency on account of caching all files in memory” really matter? The files should already be cached by the OS and using sendfile lets the OS copy the file directly to the network.

We deploy little apps internally. Users have low latency on the network - even home users we steer to use ISPs we know have low latency. I've found that speed can make a difference in user like for an app. Even going out to google etc I'm currently at 5-6 ms. Some things we might have 1000+ checkboxs to work through on a checklist (cut down by some initial tailoring steps). Even things with a small wait on a click et…

The difference of latency between serving a file cached in user-space RAM (what nano-web is doing) and serving a file from the kernel buffer cache (also in RAM) using sendfile should be totally negligible compared to the latency of your network, even if that network is "low latency".

Latency Numbers Everyone Should Know: https://static.googleusercontent.com/media/sre.google/en//st...

sendfile(2): https://man7.org/linux/man-pages/man2/sendfile.2.html

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#44

Post by hombre_fatal »

Sohcahtoa82 wrote: post #40

> SPA_MODE when set to 1 404 request will return /public/index.html as a 200. oof, as someone who frequently has to run DAST tools, returning a 200 for something that should be a 404 is the bane of my existence. The tool will try to request sensitive files by trying something as simple as fetching hxxps://example.com/../../../etc/passwd. If you return a "200 OK", it will flag as a security issue, even if the resultin…

Tripping up hare-brained security scanning tools sounds like a perk tbh.

> I don't think you can convince me that [...] is ever the correct thing to do

It's just a matter of trade-offs.

Serving the app.js on a 404 can cause things like browser/caching issues that are confusing for the user, and 404 isn't necessarily correct since the app is both servable and recoverable from that url.

And I'm not sure 302-redirecting is any less meaningless than serving 200 on a not-found. The user doesn't need the redirect since the app is already capable of handling the not-found page in a user-friendly way. So does it somehow improve things for programmatic analysis of the app to make all 40X errors redirect to the homepage, and is that very compelling?

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#45

Post by PhilippGille »

qwerty456127 wrote: post #5

By the way, is there a really minimal, really fast, reasonably secure, zero-cofig single-binary web server which would only support HTTP GET and just expose all the static content in a given directory over it?

I created this some years ago: https://github.com/philippgille/serve

It's written in Go, has zero third party dependencies, supports optional basic auth, and optional TLS cert generation (self signed) for local HTTPS.

Not updated in a while though.

And if you drop the requirement for minimalism I'd second the recommendation for Caddy instead.

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#46

Post by dspillett »

ngrilly wrote: post #23

Considering the latency between the user web browser and the server, does the “extremely low latency on account of caching all files in memory” really matter? The files should already be cached by the OS and using sendfile lets the OS copy the file directly to the network.

> serving things like Astro from S3

Given that point, I got the impression that the comparison was against loading resources from S3. The difference between that and serving from memory (even between that and serving from uncached traditional hard-drive) is going to be significant.

EDIT: cursory research suggests S3 latency (https://stackoverflow.com/a/861539/114292, being the most recent reference that turned up) is smaller than it was last time I remember needing to look into it, but still of the order of 10+ms.

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#47

Post by somethingAlex »

lukevp wrote: post #16
Brajeshwar wrote: post #4

Can you elaborate "CloudFront doesn't support index pages in subdirectories" and how does it not work? I'm not much into them these days but if I remember correctly in the 4-5 years prior, they just works! In-fact, CloudFront was easier to serve static web assets than serving directly from S3. Or have I misunderstood what you meant?

In a SPA, you want to change routes in the URL so you don’t break people’s expectations about being able to share deep links to specific pages, but those sites don’t really exist. Eg if your site is www.example.com and you have a SPA on there, and one of the pages is www.example.com/products, you want to still serve index.html from the root even though the /products path is not a real directory on your system. If you…

If you are using Cludfront with an S3 origin you can turn on static website hosting and specify a 404 fallback page[0] - which would then just be your index file. It will render your client code and let you show a 404 if it is indeed one.

The problem is that essentially every time a user goes to the site it will be a 404 status code since they are probably not typing in example.com/index but this has pragmatically not been an issue for a wholly authenticated, private, B2B SaaS app. The marketing website is a separate subdomain.

For a public site this is probably worse than returning 200s that should be 404s occasionally, though.

[0]: https://docs.aws.amazon.com/AmazonS3/latest/userguide/Custom...

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#48

Post by dclowd9901 »

qwerty456127 wrote: post #5

By the way, is there a really minimal, really fast, reasonably secure, zero-cofig single-binary web server which would only support HTTP GET and just expose all the static content in a given directory over it?

Not sure what single binary means but here’s my take.

https://github.com/dclowd9901/posse

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#49

Post by vundercind »

EGreg wrote: post #2

I like the idea! Have you seen redbean, which is a universal binary and serves static files from a zipfile? How does this compare to that? Honestly, I think that the current Web can easily use libp2p from IPFS and serve files from any browser peer to peer, with relays on the internet. I think the Web lacks two major things: 1) Address resolution only uses federated DNS and you need extensions to use, say, self-sovere…

Federation’s a non-starter when most devices people use are battery powered and don’t like to hold connections open when idle. Like, it works, but it won’t work well enough unless most devices are just going through gateways, which largely defeats the point.

Re: Show HN: Nano-web – a low latency one binary webserver designed for serving SPAs

#50

Post by phanimahesh »

__jonas wrote: post #41
Sohcahtoa82 wrote: post #40

> SPA_MODE when set to 1 404 request will return /public/index.html as a 200. oof, as someone who frequently has to run DAST tools, returning a 200 for something that should be a 404 is the bane of my existence. The tool will try to request sensitive files by trying something as simple as fetching hxxps://example.com/../../../etc/passwd. If you return a "200 OK", it will flag as a security issue, even if the resultin…

But if it's an SPA, how else would you handle this case? How is the webserver supposed to know in advance which URLs the SPA is able to handle?

Handle a prefix maybe?
Post reply on HN