0
Fork 0
mirror of https://github.com/ninenines/cowboy.git synced 2025-07-14 12:20:24 +00:00
Commit graph

1125 commits

Author SHA1 Message Date
Loïc Hoguin
defce46fdf
REST: Allow generate_etag to return undefined
This allows conditionally generating an etag.
2024-01-16 16:28:52 +01:00
geeksilva97
308045fd67
Reject responses with explicit set-cookie header
LH: The tests received a lot of fixes and tweaking.
    I also reworded the error message to be more concise.
2024-01-15 17:43:14 +01:00
Loïc Hoguin
1a175e7b56
Fix wrong HTTP/1 timeout being used in some cases
Added many tests to ensure the right timeout is picked in
the appropriate situation. Should there be any issues
remaining we can add more tests.
2024-01-15 15:18:40 +01:00
Loïc Hoguin
906a7ffc3c
Better error message when trying to reply twice
Also crash if trying to push after a reply was sent.
2024-01-09 13:06:11 +01:00
Loïc Hoguin
f0101ffe41
Shorten the 204/304 error message 2024-01-09 11:01:39 +01:00
Loïc Hoguin
a40bab8fb3
Improve the error when trying to send a 204/304 with a body 2024-01-09 10:59:40 +01:00
Loïc Hoguin
e4a78aaeb1
Document body reading in auto mode
It is now tested both via cowboy_req:read_body and
via cowboy_req:cast.

Removes a bad example from the guide of body reading
with period of infinity, which does not work.
2024-01-08 15:13:18 +01:00
Loïc Hoguin
c1490d7d55
Ensure HTTP/1.1 Websocket resets the trap_exit flag
While we are identified as a supervisor in the tree,
we no longer manage children processes at that point,
so do not need to trap exit signals. Users can still
enable trap_exit if they prefer to.
2024-01-08 11:47:59 +01:00
Loïc Hoguin
9784179498
Always add vary: accept-encoding in cowboy_compress_h
We must add it even if we don't end up compressing because
it indicates that we might. This indication doesn't mean
that the user agent's accept-encoding values will ever
result in content encoding being applied.
2024-01-08 10:22:24 +01:00
Loïc Hoguin
6ef79ae410
Reject HTTP/1 requests with both content-length and transfer-encoding
The previous behavior was to accept them and drop the
content-length header as per the RFC recommendation.
But since this behavior is not normal it is safer to
just reject such requests than risk security issues.
2024-01-05 16:32:59 +01:00
Loïc Hoguin
5b2f600036
Don't automatically compress when response has etag
In the cowboy_compress_h stream handler.

Otherwise this could cause issues with caching, with the
etag being the same for compressed/uncompressed content.

Users that wish to send etags AND compress will have to
do it manually for the time being.
2024-01-05 15:53:42 +01:00
Loïc Hoguin
67df6fedae
Add cowboy:get_env/2,3 2024-01-05 12:31:48 +01:00
Loïc Hoguin
8f49f8792a
Fix Dialyzer warnings caused by my decompress changes 2024-01-05 12:31:19 +01:00
Loïc Hoguin
fd9711d949
Rework and improve the decompress stream handler
The read buffer was changed into an iovec to avoid doing
too many binary concatenations and allocations.

Decompression happens transparently: when decoding gzip,
the content-encoding header is removed (we only decode
when "gzip" is the only encoding so nothing remains).

We always add a content_decoded key to the Req object.
This key contains a list of codings that were decoded,
in the reverse order in which they were. Currently it
can only be empty or contain <<"gzip">> but future
improvements or user handlers may see it contain more
values.

The option to disable decompression was renamed to
decompress_enabled and defaults to true.

It is no longer possible to enable/disable decompression
in the middle of reading the body: this ensures that the
data we pass forward is always valid.

Various smaller improvements were made to the code,
tests and manual pages.
2024-01-04 15:50:12 +01:00
jdamanalo
3ed1b24dd6
Add cowboy_decompress_h stream handler 2023-12-21 15:39:08 +01:00
Loïc Hoguin
ffbcdf534c
Don't update an HTTP/2 stream's window if stream stopped 2023-12-21 15:38:51 +01:00
Nelson Vides
5ef64557b5
Exit gracefully on {error,closed} when reading the PROXY header
LH: Simplified the test a little.
2023-12-21 15:01:33 +01:00
Robert J. Macomber
f74b69c3ed
Optionally reset the idle timeout when sending data
A new option reset_idle_timeout_on_send has been added.
When set to 'true', the idle timeout is reset not only
when data is received, but also when data is sent.

This allows sending large responses without having to
worry about timeouts triggering.

The default is currently unchanged but might change in
a future release.

LH: Greatly reworked the implementation so that the
    timeout gets reset on almost all socket writes.
	This essentially completely supersets the original
	work. Tests are mostly the same although I
	refactored a bit to avoid test code duplication.

This commit also changes HTTP/2 behavior a little when
data is received: Cowboy will not attempt to update the
window before running stream handler commands to avoid
sending WINDOW_UPDATE frames twice. Now it has some
small heuristic to ensure they can only be sent once
at most.
2023-12-21 14:03:07 +01:00
Viktor Söderqvist
7400b04b02
Remove next_protocols_advertised 2023-12-19 11:57:54 +01:00
Loïc Hoguin
8fdb74a510
Shave off a few more seconds from rfc7540_SUITE 2023-12-19 11:09:54 +01:00
Dmitri Vereshchagin
2558ba65ad
Fix shutdown for HTTP/1.1 pipeline
Sending extra response prevented by terminating all streams except
the one currently executing.

LH: Reworded some variables to make what happens more obvious.
2023-12-18 15:39:39 +01:00
Boris Pozdnyakov
e200272178
Reject invalid Connection header
LH: Small tweaks and added an HTTP/1.0 test.
2023-12-15 17:12:37 +01:00
jdamanalo
a81dc8af9d
Add timeout to cowboy_loop
LH: I have added a test that does both hibernate and timeout
    and fixed a related issue. I also tweaked the docs and tests.
2023-12-15 15:37:34 +01:00
Loïc Hoguin
efb681d749
Handle socket errors in HTTP/1.1 and HTTP/2
Doing so will let us notice when the connection is gone instead
of waiting for timeouts, at least in the cases where the remote
socket was closed properly. Timeouts are still needed in case
of TCP half-open problems.

This change means that the order of stream handler commands is
more important than before because socket errors may occur
during the processing of commands.
2023-12-12 15:05:33 +01:00
Viktor Söderqvist
42d87dd776
Add 'max_cancel_stream_rate' config for the rapid reset attack
Co-authored-by: Björn Svensson <bjorn.a.svensson@est.tech>
2023-12-06 12:41:58 +01:00
Loïc Hoguin
105edf1d6e
Fix data sent after RST_STREAM in HTTP/2 in rare cases 2022-09-19 14:10:32 +02:00
Martin Björklund
8795233c57
AcceptCallback may now return created/see_other tuples for POST
They replace and deprecate the {true,URI} return value.
2020-11-27 16:17:43 +01:00
Sebastian Strollo
63a6b86fba
Also include trace messages when timestamp flag isn't used 2020-11-27 16:02:54 +01:00
Simon Johansson
f6049b85a3
Use functions for inititalizing rate limiting
... to ensure that the same values are used in all places.
2020-11-27 15:51:09 +01:00
Viktor Söderqvist
059d58d39f
Graceful shutdown
Note: This commit makes cowboy depend on cowlib master.

Graceful shutdown for HTTP/2:

1. A GOAWAY frame with the last stream id set to 2^31-1 is sent and a
   timer is started (goaway_initial_timeout, default 1000ms), to wait
   for any in-flight requests sent by the client, and the status is set
   to 'closing_initiated'. If the client responds with GOAWAY and closes
   the connection, we're done.
2. A second GOAWAY frame is sent with the actual last stream id and the
   status is set to 'closing'. If no streams exist, the connection
   terminates. Otherwise a second timer (goaway_complete_timeout,
   default 3000ms) is started, to wait for the streams to complete. New
   streams are not accepted when status is 'closing'.
3. If all streams haven't completed after the second timeout, the
   connection is forcefully terminated.

Graceful shutdown for HTTP/1.x:

1. If a request is currently being handled, it is waited for and the
   response is sent back to the client with the header "Connection:
   close". Then, the connection is closed.
2. If the current request handler is not finished within the time
   configured in transport option 'shutdown' (default 5000ms), the
   connection process is killed by its supervisor (ranch).

Implemented for HTTP/1.x and HTTP/2 in the following scenarios:

* When receiving exit signal 'shutdown' from the supervisor (e.g. when
  cowboy:stop_listener/3 is called).
* When a connection process is requested to terminate using
  sys:terminate/2,3.

LH: Edited tests a bit and added todos for useful tests to add.
2020-11-27 15:38:21 +01:00
Loïc Hoguin
e12d7bbe21
Don't produce an error report for normal stream process exits 2020-11-23 11:02:01 +01:00
Loïc Hoguin
03d306e6d1
Fix concurrent body streaming getting stuck with HTTP/2 2020-07-03 11:02:59 +02:00
Loïc Hoguin
39b2816255
204 and 304 responses must not include a body
When calling cowboy_req:reply/4 with a body a crash will occur
resulting in a 500 response. When calling cowboy_req:stream_reply/2,3
and then attempting to send a body a crash will occur.
2020-05-20 13:41:05 +02:00
Loïc Hoguin
8337aca4d3
Increase the default max_keepalive HTTP option to 1000
100 is very low for current deployments. 1000 is more
appropriate as a default value.
2020-05-20 11:08:58 +02:00
Loïc Hoguin
775091134d
Experiment with a linger_timeout for HTTP/2
This is mostly to ensure that the GOAWAY frame is properly
received on Windows in some tests, but should be benefitial
also in production in particular when clients are slower.
2020-04-06 14:50:35 +02:00
Loïc Hoguin
4ab69f402e
Fix active mode and flow control during pipelining
We could get stuck in passive mode under certain conditions
(fast and non-busy machine and perhaps other environment factors).
2020-04-04 20:15:23 +02:00
Loïc Hoguin
a8a2689727
Fix h2spec "invalid preface sequence" test
Introduce a currently undocumented option to allow disabling
cowboy_http when using a clear listener.
2020-04-01 18:02:59 +02:00
Loïc Hoguin
0fc33c5300
Add more headers to cowboy_req:parse_header/2,3 2020-03-30 15:02:35 +02:00
Loïc Hoguin
70e43ec112
Add more router tests 2020-03-29 15:44:47 +02:00
Loïc Hoguin
6ad842a742
Increase the default max_received_frame_rate
Allow 10000 frames every 10 seconds instead of just 1000,
as the limit was too quickly reached in some deployments.
2020-03-29 13:51:21 +02:00
Loïc Hoguin
8fc3da2fc3
Fix HTTP/1.1 bug when a flow command is returned after fin
This resulted in a badarith error due to the current flow being
set to infinity when the body has been fully read. A test case
has been added reproducing the issue.
2020-02-07 11:32:15 +01:00
Loïc Hoguin
752297b153
Fix bugs related to HTTP/1.1 pipelining
The flow control is now only set to infinity when we are
skipping the request body of the stream that is being
terminated. This fixes a bug where it was set to infinity
while reading a subsequent request's body, leading to a
crash.

The timeout is no longer reset on stream termination.
Timeout handling is already done when receiving data
from the socket and doing a reset on stream termination
was leading to the wrong timeout being set or the right
timeout being reset needlessly.
2020-01-17 11:42:28 +01:00
Loïc Hoguin
db0d6f8d25
Use active,N
This reduces the number of times we need to ask for more packets,
and as a result we get a fairly large boost in performance,
especially with HTTP/1.1.

Unfortunately this makes Cowboy require at least Erlang/OTP 21.3+
because the ssl application did not have active,N. For simplicity
the version required will be Erlang/OTP 22+.

In addition this change improves hibernate handling in
cowboy_websocket. Hibernate will now work for HTTP/2 transport
as well, and stray or unrelated messages will no longer cancel
hibernate (the process will handle the message and go back into
hibernation).

Thanks go to Stressgrid for benchmarking an early version of this
commit: https://stressgrid.com/blog/cowboy_performance_part_2/
2020-01-06 12:58:14 +01:00
Loïc Hoguin
592029070d
Reduce number of Transport:send/2 calls for HTTP/2
When sending a complete response it is far more efficient
to send the headers and the body in one Transport:send/2
call instead of two or more, at least for small responses.

This is the HTTP/2 counterpart to what was done for HTTP/1.1
many years ago in bfab8d4b22.

In HTTP/2's case however the implementation is a little
more difficult due to flow control. On the other hand the
optimization will apply not only for headers/body but also
for the body of multiple separate responses, which may need
to be sent all at the same time when we receive a WINDOW_UPDATE
frame.

When a body is sent using sendfile however a separate call
is still made.
2020-01-02 13:29:56 +01:00
Loïc Hoguin
3a7232b019
No longer use erlang:get_stacktrace/0
It has been deprecated in OTP and the new way is available
on all supported OTP versions.
2019-12-31 15:10:38 +01:00
Marcos Ferreira
3b85b808ae
Ignore malformed accept-encoding headers in cowboy_compress_h 2019-12-31 13:48:05 +01:00
Loïc Hoguin
3ae228897a
Don't log stray messages for lingering HTTP/2 streams 2019-10-10 17:06:24 +02:00
Loïc Hoguin
a73004e966
Fix a number of low hanging todos 2019-10-10 16:04:28 +02:00
Loïc Hoguin
ecb39eea10
Newly documented cow_cookie:cookie_opts() is now a map 2019-10-10 14:52:02 +02:00
Loïc Hoguin
d52e84bdd9
Add shutdown_reason Websocket command
This allows changing the normal exit reason of Websocket
processes, providing a way to signal other processes of
why the exit occurred.
2019-10-10 11:33:35 +02:00