#if !defined(_WIN32) && !defined(__MINGW32__) && !defined(__CYGWIN__)

struct sigaction oldsig;

struct sigaction sig;

sig.sa_handler = &catcher;

sigemptyset(&sig.sa_mask);

#ifdef SA_INTERRUPT

sig.sa_flags = SA_INTERRUPT; /* SunOS */

#else // SA_INTERRUPT

sig.sa_flags = SA_RESTART;

#endif // SA_INTERRUPTT

if (0 != sigaction(SIGPIPE, &sig, &oldsig)) {

fprintf(stderr, "Failed to install SIGPIPE handler: %s\n", strerror(errno));

}

#endif

// Copy the builder's config wholesale; the feature-availability guards

// in the ctor body below throw if an option (e.g. basic_auth_enabled)

// was requested on a build that lacks it.

config(params._config),

// Derived at construction from config.auth_skip_paths (not a builder

// input), so it is initialised separately rather than copied.

auth_skip_paths_normalized(

detail::normalize_auth_skip_paths(params._config.auth_skip_paths)),

// create_webserver uses int=0 as "no pre-bound socket" to keep the

// public builder header free of <microhttpd.h>. Convert to the

// MHD_socket sentinel (MHD_INVALID_SOCKET) so the impl always uses

// a well-defined sentinel. Pass through the impl_ constructor so the

// impl is fully initialised from the member-initialiser list with no

// post-construction mutations of impl_ members.

impl_(std::make_unique<detail::webserver_impl>(

this,

(params._config.bind_socket != 0)

? static_cast<MHD_socket>(params._config.bind_socket)

: MHD_INVALID_SOCKET)) {

// Any feature the builder asked for that the

// library was not compiled with must fail loudly here. Throwing

// from the ctor body (after the member-initialiser list) lets

// the just-constructed impl_ unique_ptr destroy itself cleanly

// — no MHD daemon is running yet.

#ifndef HAVE_GNUTLS

if (config.use_ssl) {

throw feature_unavailable("tls", "HAVE_GNUTLS");

}

#endif

#ifndef HAVE_BAUTH

if (config.basic_auth_enabled) {

throw feature_unavailable("basic_auth", "HAVE_BAUTH");

}

#endif

#ifndef HAVE_DAUTH

// CWE-287: symmetric guard for digest

// auth. Without this a HAVE_DAUTH-off build silently accepts

// digest_auth_enabled=true and the request handler returns

// WRONG_HEADER, making the authentication gate a silent no-op.

if (config.digest_auth_enabled) {

throw feature_unavailable("digest_auth", "HAVE_DAUTH");

}

#endif

ignore_sigpipe();

// Register the three v1 setter aliases as hooks

// (route_resolved for not_found_handler; before_handler for

// method_not_allowed_handler and auth_handler). Conditional on

// each setter being non-null so zero-cost-when-unused holds.

install_default_alias_hooks_();

// Constexpr locals resolve each HAVE_* flag once. The aggregate-init

// braces below omit the type name to avoid the name collision between

// the return type and the member function (both spelled `features`);

// `return {a,b,c,d};` is resolved via the elaborated-type-specifier

// in the function signature above.

#ifdef HAVE_BAUTH

constexpr bool k_bauth = true;

#else

constexpr bool k_bauth = false;

#endif

#ifdef HAVE_DAUTH

constexpr bool k_dauth = true;

#else

constexpr bool k_dauth = false;

#endif

#ifdef HAVE_GNUTLS

constexpr bool k_tls = true;

#else

constexpr bool k_tls = false;

#endif

#ifdef HAVE_WEBSOCKET

constexpr bool k_ws = true;

#else

constexpr bool k_ws = false;

#endif

return {k_bauth, k_dauth, k_tls, k_ws};

// The "wait for in-flight handlers" guarantee is provided by

// MHD_stop_daemon(), which is a blocking call that drains all active

// connections and joins libmicrohttpd's worker threads before returning.

// stop() calls MHD_stop_daemon() internally, so this wrapper fulfils its

// stronger contract without additional synchronisation. If the contract

// were ever stronger than what MHD_stop_daemon() provides (e.g. an

// application-level quiesce step), the extra logic should be added here

// rather than in stop(), preserving the distinction between the two

// entry-points.

stop();

hook_phase phase,

std::uint64_t slot_id) noexcept {

return hook_handle{impl, phase, slot_id};

std::function<void(const connection_open_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::connection_opened,

impl_->hooks_.add(phase, std::move(fn)));

std::function<void(const accept_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::accept_decision,

impl_->hooks_.add(phase, std::move(fn)));

std::function<hook_action(request_received_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::request_received,

impl_->hooks_.add(phase, std::move(fn)));

std::function<hook_action(body_chunk_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::body_chunk,

impl_->hooks_.add(phase, std::move(fn)));

std::function<void(const route_resolved_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::route_resolved,

impl_->hooks_.add(phase, std::move(fn)));

std::function<hook_action(before_handler_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::before_handler,

impl_->hooks_.add(phase, std::move(fn)));

std::function<hook_action(const handler_exception_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::handler_exception,

impl_->hooks_.add(phase, std::move(fn)));

std::function<hook_action(after_handler_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::after_handler,

impl_->hooks_.add(phase, std::move(fn)));

std::function<void(const response_sent_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::response_sent,

impl_->hooks_.add(phase, std::move(fn)));

std::function<void(const request_completed_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::request_completed,

impl_->hooks_.add(phase, std::move(fn)));

std::function<void(const connection_close_ctx&)> fn) {

return make_hook_handle_(impl_.get(), hook_phase::connection_closed,

impl_->hooks_.add(phase, std::move(fn)));

if (config.start_method == http_utils::THREAD_PER_CONNECTION

&& (config.max_threads != 0 || config.max_thread_stack_size != 0)) {

throw std::invalid_argument(

"Cannot specify maximum number of threads when using a thread per connection");

}

// Fire the one-shot raw-body-dump opt-in SECURITY

// WARNING before MHD_start_daemon so the operator sees the

// notice on every fresh process invocation that actually starts

// accepting traffic. Defined in webserver_body_pipeline.cpp

// alongside the consumer of the opt-in flag.

// Maintenance invariant: this call must happen before any request

// is dispatched, and therefore before

// debug_dump_request_body_opted_in()'s magic-static is first

// initialised by the body pipeline. A future refactor that moves

// work ahead of webserver::start() (or reorders the body pipeline)

// must preserve or replicate this ordering.

detail::maybe_warn_debug_dump_request_body(this);

vector<struct MHD_OptionItem> iov;

impl_->daemon_.build_mhd_option_array(iov);

const int start_conf = impl_->daemon_.compose_start_flags();

struct MHD_Daemon* d = nullptr;

if (config.bind_address == nullptr) {

d = MHD_start_daemon(start_conf, config.port, &detail::webserver_impl::policy_callback, this,

&detail::webserver_impl::answer_to_connection, impl_.get(), MHD_OPTION_ARRAY,

&iov[0], MHD_OPTION_END);

} else {

// libmicrohttpd ignores the port argument when MHD_OPTION_SOCK_ADDR

// is supplied; the literal 1 is a placeholder that only needs to be

// non-zero.

d = MHD_start_daemon(start_conf, 1, &detail::webserver_impl::policy_callback, this,

&detail::webserver_impl::answer_to_connection, impl_.get(), MHD_OPTION_ARRAY,

&iov[0], MHD_OPTION_SOCK_ADDR, config.bind_address, MHD_OPTION_END);

}

// Release store: publish the daemon (+ its bind-port) so a concurrent get_bound_port() on another thread sees it.

impl_->daemon_.daemon.store(d, std::memory_order_release);

if (d == nullptr) {

throw std::invalid_argument("Unable to connect daemon to port: " + std::to_string(config.port));

}

impl_->daemon_.running = true;

if (blocking) {

pthread_mutex_lock(&impl_->daemon_.mutexwait);

while (impl_->daemon_.running) {

pthread_cond_wait(&impl_->daemon_.mutexcond, &impl_->daemon_.mutexwait);

}

pthread_mutex_unlock(&impl_->daemon_.mutexwait);

return true;

}

return false;

if (!impl_->daemon_.running) return false;

pthread_mutex_lock(&impl_->daemon_.mutexwait);

impl_->daemon_.running = false;

pthread_cond_signal(&impl_->daemon_.mutexcond);

pthread_mutex_unlock(&impl_->daemon_.mutexwait);

MHD_stop_daemon(impl_->daemon_.daemon.load(std::memory_order_acquire));

// Reset so the daemon != nullptr guards treat it as absent after stop().

impl_->daemon_.daemon.store(nullptr, std::memory_order_release);

// Only shut down the pre-bound socket if one was actually provided.

// MHD_INVALID_SOCKET (-1 on POSIX, INVALID_SOCKET on Windows) is the

// sentinel written by the webserver_impl constructor when no pre-bound

// socket was passed via create_webserver().bind_socket(). Without this

// guard, the unconditional shutdown() call would operate on fd MHD_INVALID_SOCKET

// which on POSIX could be interpreted as fd -1 (implementation-defined)

// and previously (before the fix) the sentinel was 0 which would have

// shut down stdin (fd 0).

if (impl_->daemon_.bind_socket != MHD_INVALID_SOCKET) {

shutdown(impl_->daemon_.bind_socket, 2);

}

return true;

struct MHD_Daemon* d = impl_->daemon_.handle();

if (d == nullptr) return -1;

MHD_socket fd = MHD_quiesce_daemon(d);

return static_cast<int>(fd);

struct MHD_Daemon* d = impl_->daemon_.handle();

if (d == nullptr) return -1;

const union MHD_DaemonInfo* info = MHD_get_daemon_info(d, MHD_DAEMON_INFO_LISTEN_FD);

if (info == nullptr) return -1;

return static_cast<int>(info->listen_fd);

struct MHD_Daemon* d = impl_->daemon_.handle();

if (d == nullptr) return 0;

const union MHD_DaemonInfo* info = MHD_get_daemon_info(d, MHD_DAEMON_INFO_CURRENT_CONNECTIONS);

if (info == nullptr) return 0;

return info->num_connections;

struct MHD_Daemon* d = impl_->daemon_.handle();

if (d == nullptr) return 0;

const union MHD_DaemonInfo* info = MHD_get_daemon_info(d, MHD_DAEMON_INFO_BIND_PORT);

if (info == nullptr) return 0;

return info->port;

struct MHD_Daemon* d = impl_->daemon_.handle();

if (d == nullptr) return false;

return MHD_run(d) == MHD_YES;

struct MHD_Daemon* d = impl_->daemon_.handle();

if (d == nullptr) return false;

return MHD_run_wait(d, millisec) == MHD_YES;

fd_set* except_fd_set, int* max_fd) {

// The signature uses typed fd_set* rather than void*,

// restoring compile-time type safety. The public header pulls in

// <sys/select.h> / <winsock2.h> directly because fd_set is a typedef

// and cannot be portably forward-declared.

struct MHD_Daemon* d = impl_->daemon_.handle();

if (d == nullptr) return false;

MHD_socket mhd_max_fd = 0;

if (MHD_get_fdset(d,

read_fd_set,

write_fd_set,

except_fd_set,

&mhd_max_fd) != MHD_YES) {

return false;

}

*max_fd = static_cast<int>(mhd_max_fd);

return true;

struct MHD_Daemon* d = impl_->daemon_.handle();

if (d == nullptr) return false;

MHD_UNSIGNED_LONG_LONG mhd_timeout = 0;

if (MHD_get_timeout(d, &mhd_timeout) != MHD_YES) {

return false;

}

*timeout = static_cast<uint64_t>(mhd_timeout);

return true;

// The public signature accepts `unsigned int` instead of

// `socklen_t` so the public header does not need <sys/socket.h>.

// POSIX guarantees `socklen_t` is an unsigned integer of at least 32

// bits; `unsigned int` matches on every supported platform.

// (The sizeof static_assert is at file scope above.)

struct MHD_Daemon* d = impl_->daemon_.handle();

if (d == nullptr) return false;

return MHD_add_connection(d, client_socket, addr,

static_cast<socklen_t>(addrlen)) == MHD_YES;

const std::shared_ptr<http_resource>& res, bool family) const {

if (res == nullptr) {

throw std::invalid_argument("The http_resource pointer cannot be null");

}

if (config.single_resource && ((resource != "" && resource != "/") || !family)) {

throw std::invalid_argument(

"The resource should be '' or '/' and be registered via "

"register_prefix when using a single_resource server");

}

// Lightweight input hygiene (CWE-20): reject paths containing embedded

// null bytes, matching validate_on_methods_inputs_'s guard for on_*/

// route. A std::string can hold '\0' but the underlying regex and

// routing engines treat it as a string terminator, producing silent

// mismatches. Reject early with a clear diagnostic rather than letting

// the error surface deep in regex compilation or route matching.

if (resource.find('\0') != std::string::npos) {

throw std::invalid_argument(

"Route path must not contain embedded null bytes");

}

std::shared_ptr<http_resource> res,

bool family) {

validate_register_inputs_(resource, res, family);

detail::http_endpoint idx(resource, family, true, config.regex_checking);

// Duplicate detection happens entirely

// inside register_v2_route, which takes its own unique_lock on

// route_table_mutex_ and runs reject_terminus_collision (plus a

// tier-classification probe for the exact tier) BEFORE any mutation.

// A duplicate at any tier surfaces as std::invalid_argument with the

// table still in its prior state -- no rollback required.

//

// Ownership contract: when register_v2_route throws,

// the shared_ptr parameter `res` (and any unique_ptr-derived shared_ptr

// funnelled through the webserver.hpp inline template shim) is destroyed

// by exception unwinding, cleanly releasing the resource.

impl_->routes_.register_v2_route(idx, std::move(res), family);

impl_->routes_.invalidate_route_cache();

detail::http_endpoint he(resource, family, true, config.regex_checking);

// Erase from the v2 3-tier table.

// Lock ordering: route_table_mutex_ -> route_lru_cache's internal

// mutex (inside invalidate_route_cache). Table lock released before

// the LRU cache is cleared, matching register_impl_ / on_methods_.

{

auto table_lock = impl_->routes_.lock_for_write();

const std::string& key = he.get_url_complete();

if (family) {

impl_->routes_.remove_param_prefix_locked_(key, /*is_prefix=*/true);

} else if (!he.get_url_pars().empty()) {

impl_->routes_.remove_param_prefix_locked_(key, /*is_prefix=*/false);

} else {

// Erase from exact tier; also sweep regex tier (url_complete key).

impl_->routes_.erase_exact_and_regex_locked_(key);

}

}

impl_->routes_.invalidate_route_cache();

// Build the canonical endpoint key once. The family flag does not

// affect which v2 storage location holds the entry; the

// url_complete key is the only sweep key.

detail::http_endpoint he_exact(resource, /*family=*/false, true, config.regex_checking);

// Erase from the v2 3-tier table. Hold a single write-lock

// across all four tier sweeps so no request thread can observe a

// partially-unregistered state (CWE-367 TOCTOU: a prior register_path

// AND register_prefix on the same path are both cleared atomically).

{

auto table_lock = impl_->routes_.lock_for_write();

const std::string& key = he_exact.get_url_complete();

// Sweep every tier the key could occupy so a prior register_path AND

// register_prefix on the same path are both cleared atomically.

impl_->routes_.erase_exact_and_regex_locked_(key);

impl_->routes_.remove_param_prefix_locked_(key, /*is_prefix=*/false);

impl_->routes_.remove_param_prefix_locked_(key, /*is_prefix=*/true);

}

// Delegate cache clearing to invalidate_route_cache() matching the

// pattern used by register_impl_ and on_methods_ (table lock released

// before cache is cleared).

impl_->routes_.invalidate_route_cache();

const std::string& path,

const std::function<http_response(const http_request&)>& handler) const {

if (methods.empty()) {

throw std::invalid_argument(

"route(method_set, ...) requires at least one method bit set");

}

if (!handler) {

throw std::invalid_argument(

"The handler function passed to on_*/route must be non-empty");

}

// Same single-resource constraint as register_path: only "" or "/"

// is acceptable. register_impl_'s version of this guard

// (webserver_register.cpp) has an additional `!family` arm; it is

// deliberately omitted here because on_*/route routes are ALWAYS

// exact-matched (family=false by design -- prefix matching is only

// available via register_prefix()), so the arm would always be

// true. The guard below is therefore complete for lambda routes.

if (config.single_resource && path != "" && path != "/") {

throw std::invalid_argument(

"When using a single_resource server, on_*/route requires "

"the path to be '' or '/'");

}

// Lightweight input hygiene (CWE-20): reject paths containing embedded

// null bytes. A std::string can hold '\0' but the underlying regex and

// routing engines treat it as a string terminator, producing silent

// mismatches. Reject early with a clear diagnostic rather than letting

// the error surface deep in regex compilation or route matching.

if (path.find('\0') != std::string::npos) {

throw std::invalid_argument(

"Route path must not contain embedded null bytes");

}

// Hardening: registration is a privileged

// server-setup call, not a network-reachable path, but an

// accidentally megabyte-scale path would still be stored in the

// route table data structures for no benefit. Reject unreasonably

// long paths early with a clear diagnostic.

if (path.size() > 8192) {

throw std::invalid_argument(

"Route path exceeds maximum length of 8192 bytes");

}

const std::string& path,

std::function<http_response(const http_request&)> handler) {

validate_on_methods_inputs_(methods, path, handler);

detail::http_endpoint idx(path, /*family=*/false,

/*registration=*/true, config.regex_checking);

{

// Single-locked window across the v2 conflict probe, the

// per-method atomicity pre-check, the slot writes, and the

// table mutation. route_table_mutex_ is the only consistency

// boundary and must cover both the probe and the mutation. An

// upsert throw (e.g. reject_terminus_collision) leaves the

// local shim unreferenced and discarded -- no rollback required

// since the table itself was never touched.

auto table_lock = impl_->routes_.lock_for_write();

// is_new_entry is the bool prepare_or_create_lambda_shim

// returns as /*fresh=*/ and upsert_v2_table_entry_locked_

// receives as `fresh` -- the same flag under three names.

auto [shim, is_new_entry] =

impl_->prepare_or_create_lambda_shim(idx, methods);

impl_->commit_handlers_to_shim(*shim, methods, std::move(handler));

impl_->routes_.upsert_v2_table_entry_locked_(idx, methods, shim,

is_new_entry);

}

impl_->routes_.invalidate_route_cache();

const std::string& path,

std::function<http_response(const http_request&)> handler) {

if (m == http_method::count_) {

throw std::invalid_argument(

"http_method::count_ is a sentinel and may not be "

"registered as a route");

}

on_methods_(method_set{}.set(m), path, std::move(handler));

const std::string& path,

std::function<http_response(const http_request&)> handler) {

// method_set::set() does not validate its argument; a caller who

// passes only count_ bits produces a non-empty bitmask (the

// count_ bit lies outside 0..count_-1) that for_each_requested_method

// will iterate over zero times, resulting in an empty shim. The

// on_methods_ empty() guard uses bits==0 and therefore does not catch

// this edge case. The single-method route(http_method,...) already

// guards against http_method::count_ explicitly; for the method_set

// overload we rely on the documented precondition that callers only

// set valid method bits. No additional sentinel check is added here

// because method_set is a user-visible type and validating its

// internal representation would duplicate policy already owned by

// method_set itself.

on_methods_(methods, path, std::move(handler));

std::shared_ptr<websocket_handler> handler) {

#ifdef HAVE_WEBSOCKET

if (!handler) {

throw std::invalid_argument("The websocket_handler pointer cannot be null");

}

std::string url_key = http_utils::standardize_url(resource);

if (!impl_->ws_.try_register(std::move(url_key), std::move(handler))) {

// v1's operator[]-based insert silently overwrote; v2.0

// surfaces the collision by throwing.

throw std::invalid_argument(

"A websocket_handler is already registered at this path");

}

#else

// WebSocket compiled out -- fail loudly at the public

// entry point so callers can catch feature_unavailable.

(void)resource;

(void)handler;

throw feature_unavailable("websocket", "HAVE_WEBSOCKET");

#endif

#ifdef HAVE_WEBSOCKET

impl_->ws_.unregister(http_utils::standardize_url(resource));

#else

(void)resource;

throw feature_unavailable("websocket", "HAVE_WEBSOCKET");

#endif

detail::webserver_impl* impl,

internal_error_handler_t user_handler) {

if (user_handler == nullptr) return;

// set_handler_exception_alias also arms any_hooks_[handler_exception]

// so the gate stays the canonical zero-cost fast-check regardless of

// whether hooks are in the vector or only in the alias slot.

impl->hooks_.set_handler_exception_alias(

[user_handler = std::move(user_handler)](

const handler_exception_ctx& ctx) -> hook_action {

// conn->request is always non-null at the call site in

// handle_dispatch_exception; this guard is purely defensive for

// any future call site that relaxes that invariant. If that

// invariant is violated in debug builds, assert fires first.

assert(ctx.request != nullptr &&

"handler_exception_ctx::request must be non-null");

if (ctx.request == nullptr) return hook_action::pass();

return hook_action::respond_with(

user_handler(*ctx.request, ctx.message));

});

for (unsigned char c : sv) {

out += (c < 0x20 || c == 0x7f) ? '-' : static_cast<char>(c);

}

detail::webserver_impl* impl,

log_access_ptr user_logger) {

if (user_logger == nullptr) return;

impl->hooks_.set_log_access_alias(

[user_logger = std::move(user_logger)](

const response_sent_ctx& ctx) {

if (ctx.request == nullptr) return;

std::string_view path = ctx.request->get_path();

std::string_view method = ctx.request->get_method();

std::string line;

// Reserve exactly what this request needs (path + " METHOD: " +

// method) instead of a fixed guess, so paths/methods longer than

// ~50 bytes don't trigger a reallocation mid-append.

line.reserve(path.size() + method.size() + 9);

// Append path and method with control-character sanitization

// (CWE-117). Append string_view directly to avoid intermediate

// heap allocations (performance: saves two alloc/dealloc pairs

// per request vs. the previous std::string(sv) approach).

append_sanitized(line, path);

line += " METHOD: ";

append_sanitized(line, method);

user_logger(line);

});