kcgi: The C library that sandboxes untrusted HTTP input
Kcgi – minimal CGI and FastCGI library for C/C++
kcgi is a minimal, secure CGI and FastCGI library for C/C++. Its standout feature: parsing and validation of untrusted network data happen in a sandboxed child process, so exploitable bugs can't touch the system. It supports auto-compression, cookies, multipart forms, authentication, and JSON/XML writers. Version 1.0.1 fixes Mac OS X shared library naming. The library runs on Linux, BSD, Solaris, and macOS, and includes a full regression test suite.
Security comes at a price—but not a stiff price.
- bitbasher
In case anyone missed it, there was an HN post about writing a web application in C using CGI a day or two ago.
- Bluestein
(In this pseudo-resurgence of common sense, somebody ought to at least have a passing memory in mention, of perl, the OG CGI language ...)
All hail TIMTOWTDI! :)
- juliangoldsmith
This reminds me a bit of when I implemented TodoMVC in C, though I used fcgi for that: https://github.com/julian-goldsmith/todomvc-c
- hatefulheart
Everyone in this thread is going to call out issues with writing a Web application using C.
Refer to the newest Talk Python podcast where a core CPython developer was told that Python is memory safe and his response was “is it?”.
At some point we need to be more sophisticated about this, our hardware is fundamentally unsafe, anything we build on it is fundamentally unsafe and there are degrees to which things are better or worse and that’s it. All that matters is the love, rigour and care you put into your work.
Proceed as you wish, a backend in C is valid a backend in LISP is valid.
- self_awareness
Anyone brave enough to write a webapp in C++?