3 ms·

Bonus fact: I wanted the 'app' (https://jakearchibald.com/2021/cors/playground/ https://jakearchibald.com/2021/cors/playground/) to allow the HTTP method to be

Bonus fact: I wanted the 'app' (https://jakearchibald.com/2021/cors/playground/ https://jakearchibald.com/2021/cors/playground/) to allow the HTTP method to be set to anything, which meant I needed a server that could accept anything. I usually use NodeJS, but it turns out the HTTP library they use turns the HTTP method into an enum, so only a subset is supported (https://github.com/nodejs/node/blob/d798de1c653efa5ec0015d44f266db6dda197bf4/deps/llhttp/include/llhttp.h#L121 https://github.com/nodejs/node/blob/d798de1c653efa5ec0015d44...). This restriction only exists in their HTTP/1 library, their HTTP/2 library supports any method. Anyway, I couldn't use that, so I used Deno via Deno Deploy. Their HTTP library supports any method, and the APIs they use are very similar to web APIs, so it was really easy to get started. Here's the server code: https://github.com/jakearchibald/cors-playground/blob/main/index.ts https://github.com/jakearchibald/cors-playground/blob/main/i....

chrismorgan 5y ago
My recollection from circa 2013 is that Node.js at least used to use the nginx HTTP parser, which was a horror of manually-implemented state machine written so in the name of performance, but consequently basically unmaintainable and fairly bug-riddled. And not as fast as it should have been, anyway. (The state machine approach is fine, but it should have used a lot more code generation.) It read the method byte by byte into the state machine, and baulked at unknown methods. Evidently they’ve kept that limitation, whatever they may have changed since in the parser they use (and I think nginx did eventually abandon and replace that parser entirely). (These are my recollections from investigation I did back in 2013 when I was writing the first serious Rust HTTP library.)
- jaffathecake 5y ago
  Whoa, I didn't know that! But yeah, it seems like https://github.com/nodejs/http-parser https://github.com/nodejs/http-parser is based on nginx. It now uses https://github.com/nodejs/llhttp https://github.com/nodejs/llhttp but has some of the same legacy. On the other hand, deno's HTTP stuff is built on top of Hyper, a Rust library https://github.com/hyperium/hyper https://github.com/hyperium/hyper
- TechBro8615 5y ago
  Sounds like a security researcher could have some fun comparing old nginx patches to whatever got pulled into the node codebase.
fadikhadra 5y ago
Hey Jake, would love to see this topic discussed in HTTP 203!
- jaffathecake 5y ago
  We've got an episode on Deno https://www.youtube.com/watch?v=SYkzk_j3yb0&list=PLNYkxOF6rcIAKIQFsNbV0JDws_G_bnNo9&index=5 https://www.youtube.com/watch?v=SYkzk_j3yb0&list=PLNYkxOF6rc..., and another which covers cross-origin fetches https://www.youtube.com/watch?v=vfAHa5GBLio&list=PLNYkxOF6rcIAKIQFsNbV0JDws_G_bnNo9&index=25 https://www.youtube.com/watch?v=vfAHa5GBLio&list=PLNYkxOF6rc... (although it isn't CORS specific), or did you mean something more specific?
  - fadikhadra 5y ago
    I guess I missed that one https://www.youtube.com/watch?v=vfAHa5GBLio&list=PLNYkxOF6rcIAKIQFsNbV0JDws_G_bnNo9&index=25 https://www.youtube.com/watch?v=vfAHa5GBLio&list=PLNYkxOF6rc.... Will have a look thanks for sharing.

chrismorgan 5y ago

My recollection from circa 2013 is that Node.js at least used to use the nginx HTTP parser, which was a horror of manually-implemented state machine written so in the name of performance, but consequently basically unmaintainable and fairly bug-riddled. And not as fast as it should have been, anyway. (The state machine approach is fine, but it should have used a lot more code generation.) It read the method byte by byte into the state machine, and baulked at unknown methods. Evidently they’ve kept that limitation, whatever they may have changed since in the parser they use (and I think nginx did eventually abandon and replace that parser entirely). (These are my recollections from investigation I did back in 2013 when I was writing the first serious Rust HTTP library.)

jaffathecake 5y ago
Whoa, I didn't know that! But yeah, it seems like https://github.com/nodejs/http-parser https://github.com/nodejs/http-parser is based on nginx. It now uses https://github.com/nodejs/llhttp https://github.com/nodejs/llhttp but has some of the same legacy. On the other hand, deno's HTTP stuff is built on top of Hyper, a Rust library https://github.com/hyperium/hyper https://github.com/hyperium/hyper
TechBro8615 5y ago
Sounds like a security researcher could have some fun comparing old nginx patches to whatever got pulled into the node codebase.

fadikhadra 5y ago

Hey Jake, would love to see this topic discussed in HTTP 203!

jaffathecake 5y ago
We've got an episode on Deno https://www.youtube.com/watch?v=SYkzk_j3yb0&list=PLNYkxOF6rcIAKIQFsNbV0JDws_G_bnNo9&index=5 https://www.youtube.com/watch?v=SYkzk_j3yb0&list=PLNYkxOF6rc..., and another which covers cross-origin fetches https://www.youtube.com/watch?v=vfAHa5GBLio&list=PLNYkxOF6rcIAKIQFsNbV0JDws_G_bnNo9&index=25 https://www.youtube.com/watch?v=vfAHa5GBLio&list=PLNYkxOF6rc... (although it isn't CORS specific), or did you mean something more specific?
- fadikhadra 5y ago
  I guess I missed that one https://www.youtube.com/watch?v=vfAHa5GBLio&list=PLNYkxOF6rcIAKIQFsNbV0JDws_G_bnNo9&index=25 https://www.youtube.com/watch?v=vfAHa5GBLio&list=PLNYkxOF6rc.... Will have a look thanks for sharing.