Web server

History

Initial WWW project (1989–1991)

• a graphical web browser, called WorldWideWeb;
• a portable line mode web browser;
• a web server, later known as CERN httpd.

Fast and wild development (1991–1995)

Explosive growth and competition (1996–2014)

New challenges (2015 and later years)

• protocols HTTP/1.x would have been supported anyway by browsers for a very long time so that there would be no incompatibility between clients and servers in next future;
• implementing HTTP/2 was considered a task of overwhelming complexity that could open the door to a whole new class of bugs that till 2015 did not exist and so it would have required notable investments in developing and testing the implementation of the new protocol;
• adding HTTP/2 support could always be done in future in case the efforts would be justified.

Technical overview

• common features implemented;
• common tasks performed;
• performances and scalability level aimed as a goal;
• software model and techniques adopted to achieve wished performance and scalability level;
• target hardware and category of usage.

Common features

• Static content serving: to be able to serve static content to clients via HTTP protocol.
• HTTP: support for one or more versions of HTTP protocol in order to send versions of HTTP responses compatible with versions of client HTTP requests,.
• Logging: usually web servers have also the capability of logging some information, about client requests and server responses, to log files for security and statistical purposes.

• Dynamic content serving: to be able to serve dynamic content to clients via HTTP protocol.
• Virtual hosting: to be able to serve many websites using only one IP address.
• Authorization: to be able to allow, to forbid or to authorize access to portions of website paths.
• Content cache: to be able to cache content in order to speed up server responses;
• file support">Computer file">file support: to be able to serve files whose size is greater than 2 GB on 32 bit OS.
• Bandwidth throttling: to limit the speed of content responses in order to not saturate the network and to be able to serve more clients;
• Rewrite engine: to map parts of clean URLs to their real names.
• Custom error pages: support for customized HTTP error messages.

Common tasks

• starts, optionally reads and applies settings found in its configuration files or elsewhere, optionally opens log file, starts listening to client connections and requests;
• optionally tries to adapt its general behavior according to its settings and its current operating conditions;
• manages client connections ;receives client requests :
• * reads and verify each HTTP request message;
• * usually performs URL normalization;
• * usually performs URL mapping ;
• * usually performs URL path translation along with various security checks;executes or refuses requested HTTP method:
• * optionally manages URL authorizations;
• * optionally manages URL redirections;
• * optionally manages requests for static resources :
• ** optionally manages directory index files;
• ** optionally manages regular files;
• * optionally manages requests for dynamic resources:
• ** optionally manages directory listings;
• ** optionally manages program or module processing, checking the availability, the start and eventually the stop of the execution of external programs used to generate dynamic content;
• ** optionally manages the communications with external programs or internal modules used to generate dynamic content;replies to client requests sending proper HTTP responses eventually verifying or adding HTTP headers to those sent by dynamic programs and modules;
• optionally logs 'client requests or its responses to an external user log file or to a system log file by syslog, usually using common log format;
• optionally logs process messages about detected anomalies or other notable events using syslog or some other system facilities; these log messages usually have a debug, warning, error, alert level which can be filtered depending on some settings, see also severity level;
• optionally generates statistics' about web traffic managed or its performances;
• other custom tasks.

Read request message

• to read an HTTP request message;
• to interpret it;
• to verify its syntax;
• to identify known HTTP headers and to extract their values from them.

URL normalization

• make resource path always a clean uniform path from root directory of website;
• lower security risks ;
• make path of web resources more recognizable by human beings and web log analysis programs.

[|URL mapping]

"URL mapping is the process by which a web server or application framework determines how an incoming URL request is routed to the appropriate resource, handler, or action. Modern URL mapping mechanisms analyse the structure of the requested URL and use routing rules or configuration patterns to deliver [|static resources], invoke dynamic handlers, or perform rewrites and redirects without directly relying on file system paths. This approach allows clean, human-readable URLs and flexible application architectures.

• URL redirection, a redirection to another URL;static request of file content;dynamic request of:
• * directory listing of files or other sub-directories contained in that directory;
• * other types of dynamic request in order to identify the program or module processor able to handle that kind of URL path and to pass to it other URL parts,.

[|URL path translation] to file system

• a local, usually non-executable, file ;
• a local directory ;
• a program name.

Manage request message

• if something in request was not acceptable, web server already sent an [|error response];
• if request has a method that can be satisfied by general code of web server then a successful response is sent;
• if URL requires authorization then an authorization error message is sent;
• if URL maps to a redirection then a redirect message is sent;
• if URL maps to a dynamic resource then its handler is called and request parameters are passed to it in order to allow it to reply to that request;
• if URL maps to a static resource then the internal static handler is called to send that file;
• if request method is not known or if there is some other unacceptable condition then an error response is sent.

Serve static content

Directory index files

Regular files

Serve dynamic content

Directory listings

Program or module processing

• files ;
• databases ;
• other sources located in local computer or in other computers.

• a document ;
• an image;
• a video;
• structured data .

Send response message

Error message

• HTTP client errors, due to the type of request message or to the availability of requested web resource;
• HTTP server errors, due to internal server errors.

URL authorization

• can be freely accessed by everybody;
• requires a user authentication ;
• access is forbidden to some or all kind of users.

• can deny access by sending a specific error message ;
• may deny access by sending a specific error message that usually forces the client browser to ask human user to provide required user credentials; if authentication credentials are provided then web server program verifies and accepts or rejects them.

[|URL redirection]

• to fix a directory name by adding a final slash '/';
• to give a new URL for a no more existing URL path to a new path where that kind of web resource can be found.
• to give a new URL to another domain when current domain has too much load.

Successful message

Content cache

• static content:
• * file cache;
• dynamic content:
• * dynamic cache.

File cache

Dynamic cache

Kernel-mode and user-mode web servers

Performances

Performance metrics

• ;
• , is the number of connections per second accepted by web server ;
• + response time for each new client request; usually benchmark tool shows how many requests have been satisfied within a scale of time laps or the shortest, the average and the longest response time;
• , in bytes per second.

Software efficiency

• single process or multi-process;
• single thread or multi-thread for each process;
• usage of coroutines or not;

• minimization of possible CPU cache misses;
• minimization of possible CPU branch mispredictions in critical paths for speed;
• minimization of the number of system calls used to perform a certain function or task;
• other tricks;

Operating conditions

• the settings of web server ;
• the HTTP version used by client requests;
• the average HTTP request type ;
• whether the requested content is static or dynamic;
• whether the content is cached or not cached ;
• whether the content is compressed on the fly, pre-compressed or not compressed at all;
• whether the connections are or are not encrypted;
• the average network speed between web server and its clients;
• the number of active TCP connections;
• the number of active processes managed by web server ;
• the hardware and software limitations or settings of the OS of the computers on which the web server runs;
• other minor conditions.

Benchmarking

Load limits

Causes of overload

• Distributed Denial of Service attacks. A denial-of-service attack or distributed denial-of-service attack is an attempt to make a computer or network resource unavailable to its intended users.
• Computer worms that sometimes cause abnormal traffic because of millions of infected computers.
• XSS worms can cause high traffic because of millions of infected browsers or web servers.
• Internet bots Traffic not filtered or limited on large websites with very few network resources or hardware resources.
• Internet slowdowns so that client requests are served more slowly and the number of connections increases so much that server limits are reached.
• Web servers, serving dynamic content, waiting for slow responses coming from back-end computers, maybe because of too many queries mixed with too many inserts or updates of DB data; in these cases web servers have to wait for back-end data responses before replying to HTTP clients but during these waits too many new client connections or requests arrive and so they become overloaded.
• Web servers partial unavailability. This can happen because of required or urgent maintenance or upgrade, hardware or software failures such as back-end failures; in these cases the remaining web servers may get too much traffic and become overloaded.

Symptoms of overload

• Requests are served with delays.
• The web server returns an HTTP error code, such as 500, 502, 503, 504, 408, or even an intermittent 404.
• The web server refuses or resets TCP connections before it returns any content.
• In very rare cases, the web server returns only a part of the requested content. This behavior can be considered a bug, even if it usually arises as a symptom of overload.

Anti-overload techniques

• Tuning OS parameters for hardware capabilities and usage.
• Tuning web servers parameters to improve their security and performances.
• Deploying techniques.
• Managing network traffic, by using:
• * Firewalls to block unwanted traffic coming from bad IP sources or having bad patterns;
• * HTTP traffic managers to drop, redirect or rewrite requests having bad HTTP patterns;
• * Bandwidth management and traffic shaping, in order to smooth down peaks in network usage.
• Using different domain names, IP addresses and computers to serve different kinds of content; the aim is to separate big or huge files from small and medium-sized files and from main dynamic site ; the idea is to be able to efficiently serve big or huge files and to fully cache small and medium-sized files, without affecting performances of dynamic site under heavy load, by using different settings for each of web server computers:
• * https://download.example.com
• * https://static.example.com
• * https://www.example.com
• Using many web servers that are grouped together behind a load balancer so that they act or are seen as one big web server.
• Adding more hardware resources to each computer.
• Using more efficient computer programs for web servers.
• Using the most efficient to process dynamic requests.
• Using other programming techniques and workarounds, especially if dynamic content is involved, to speed up the HTTP responses, that never change or change very rarely, by copying that content to static files once and then keeping them synchronized with dynamic content.
• Using latest efficient versions of HTTP in order to reduce a lot the number of TCP/IP connections started by each client and the size of data exchanged. This may not prevent overloads of RAM and CPU caused by the need for encryption. It may also not address overloads caused by excessively large files uploaded at high speed, because they are optimized for concurrency.

Market share