61–70 of 119 posts
By the way, is there a really minimal, really fast, reasonably secure, zero-cofig single-binary web server which would only support HTTP GET and just expose all the static content in a given directory over it?
Earlier quoted context omitted.
I wrote filed[0] for this. It is VERY fast in terms of low-latency (it doesn't even open the file its serving if it can help it) -- although it doesn't generate a dynamic directory listing, so it may not meet your needs if you want any dynamic content like that. [0] https://filed.rkeene.org/
actually readable C. kudos
By the way, is there a really minimal, really fast, reasonably secure, zero-cofig single-binary web server which would only support HTTP GET and just expose all the static content in a given directory over it?
Here's[5] an example I put together that I have running on fly.io[6]. I'm doing a redirect for root path, but it could easily be changed to serve up the contents of index.html.
I use a similar deployment for a small site I created[7] to generate UUIDs. Kemal[8] also looks like a good alternative.
----
Update:
Here's[9] an example also running on fly.io[10] using Kemal[8]
[1] https://crystal-lang.org/api/1.11.2/HTTP/Server.html
[2] https://crystal-lang.org/reference/1.11/guides/static_linkin...
[3] https://docs.docker.com/build/building/multi-stage/
[4] https://hub.docker.com/_/scratch/
[5] https://github.com/adrianlv512/minimal-server
[6] https://minimal-server.fly.dev
[7] https://uuid-generator.org/
> SPA_MODE when set to 1 404 request will return /public/index.html as a 200. oof, as someone who frequently has to run DAST tools, returning a 200 for something that should be a 404 is the bane of my existence. The tool will try to request sensitive files by trying something as simple as fetching hxxps://example.com/../../../etc/passwd. If you return a "200 OK", it will flag as a security issue, even if the resultin…
Tripping up hare-brained security scanning tools sounds like a perk tbh. > I don't think you can convince me that [...] is ever the correct thing to do It's just a matter of trade-offs. Serving the app.js on a 404 can cause things like browser/caching issues that are confusing for the user, and 404 isn't necessarily correct since the app is both servable and recoverable from that url. And I'm not sure 302-redirecting…
Is there a benefit for doing so?
Earlier quoted context omitted.
Yep, returning the wrong HTTP status code is going to confuse a lot of search engines, chat app link previews, and other automated consumers of your SPA, even if you subsequently display the correct error page.
>returning the wrong HTTP status code is going to confuse a lot of search engines How is the search engine going to find a page that doesn't exist, isn't in a sitemap, isn't linked to in any nav anchors, in order to index it?
Considering the latency between the user web browser and the server, does the “extremely low latency on account of caching all files in memory” really matter? The files should already be cached by the OS and using sendfile lets the OS copy the file directly to the network.
I just figured any savings where savings can be made is a good thing, especially if there are zero downsides, plus it means very low CPU usage as it's literally just pulling from RAM without any CPU usage. It also precaches gzipped and brotli'd versions of sensible files so that it can accept-encoding for a variety of browsers.
If you're really concerned you can MMAP the file instead, and do a read every once in a while to keep it cached.
There are a lot of cases where this kind of functionality could cause big problems, and very few where it has more than a marginal improvement over what your OS is already doing. Just read the file every once in a while to keep it in memory cache.
Earlier quoted context omitted.
But if it's an SPA, how else would you handle this case? How is the webserver supposed to know in advance which URLs the SPA is able to handle?
I typically keep all my SPA routes/route names in a single JSON, and then reference those from the App, instead of repeating the routes everywhere. I can then pass those to the server to let it know what the SPA can handle.