4 ms·
FastCGI: The protocol provides the single and fast interface to serve dynamic content That's a bad choice in my opinion. Without reverse proxy functionality ht
by andor 12y ago
FastCGI: The protocol provides the single and fast
interface to serve dynamic content
That's a bad choice in my opinion. Without reverse proxy functionality httpd can't match the flexibility of nginx.
- jedisct1 12y agoThis is needed at least for PHP. Granted, PHP has a built-in web server, but it's really just for testing and not meant to be a replacement for fpm. Maybe reverse proxying is coming up next, as well as HTTP2. But once again, the goal is not to have a full-featured server that can replace Nginx. Rather something small, simple and secure.
- twic 12y agorelayd does reverse proxying in OpenBSD: https://calomel.org/relayd.html https://calomel.org/relayd.html So there's no need for httpd to do it as well.
- pyvpx 12y agoplease do not link to calomel.org. OpenBSD takes great care to have clear, concise, accurate documentation available both on the system and on the web. link to the man page! calomel.org is filled with...ignorance, to say the least.
- twic 12y agoI had a look at the relayd man page, but it's not actually very useful. I wanted a document that would demonstrate the use of relayd as an http proxy server. The man page doesn't even mention http. If you would like to suggest a better reference, i will happily edit my post.
- knivets 12y agoWhy is it a bad choice? Why does it need reverse proxy functionality? Why not use some reverse proxy software (e.g. HAProxy) in order to follow the UNIX modular principle? I'm not trying to argue here, but rather trying to understand.
- skissane 12y agoWhy bother with FastCGI? Why not just use reverse proxy HTTP instead? Why introduce yet another protocol when HTTP works fine? I didn't write this, but I agree with it - https://ef.gy/fastcgi-is-pointless https://ef.gy/fastcgi-is-pointless
- tedunangst 12y agoIf you want reverse proxy, run relayd. But slowcgi (and therefore bgplg, man.cgi, etc.) already use fastcgi.
- MichaelGG 12y agoReverse proxying isn't the same. Information that's critical to some apps, like client certs or socket info, isn't available without hacking up custom headers and mixing that trusted data in with the untrusted client message. Due to HTTP's supremely obtuse parsing rules, this can be exploitable even when being defensive. I've personally seen this in SIP proxing (ganked the parsing from HTTP) leading to simply unparseable messages due to irreconcilable differences in deployed software. Yeah, FastCGI introduces a whole other attack surface, but it's on a trusted boundary, at least. Mixing trust levels within content seems like one of the primary classes of security problems.
- tveita 12y agoUnsurprisingly his "400-ish line C++ header that implements an HTTP server" falls far short of supporting the full HTTP spec. For instance it looks like multiple occurrences of the same header will be ignored, and it will just close the connection instead of returning status 400 on protocol errors - in the best case. Sure, you can try to implement just the parts of the HTTP spec that you think you'll need, and hope for the best. But wouldn't you rather use a simpler protocol that you could implement fully without having to worry about subtle errors sneaking in because you parsed the request line slightly wrong, or because your proxy decides to send two X-Forwarded-For headers instead of one. If you're writing in Java or C++ you'll be able to find a mature HTTP library that handles all of this for you, but if for whatever reason I were writing from scratch, I'd take a limited-purpose protocol like FastCGI any day.
- hobarrera 12y agoI believe relayd is mean to serve that purpose.