v21 and io_uring

With more features added, more optimizations and more examples working properly, here's the current performance metrics comparing uWS v21 against latest denoland/fastwebsockets v0.4.2. As an aside, uWS can now do URL routed HTTP requests at 350k req/sec, which is even faster than what an optimized epoll server can do raw TCP echoing (325k msg/sec) on this machine. Just think about that for a moment - uWS is serving standards compliant HTTP faster than you could do even raw TCP a few years ago. Mind blown.

uWS never cared to optimize non-SSL, non-compressed semi-big WebSocket message sending, and so was a bit slower than what denoland/fastwebsockets v0.4.2 presented. This release adds such optimization and is now reliably and significantly faster in all cases.

Also, keep up to date for news on the v21 release where io_uring will be default and we see even bigger outperformance.

Linux 6.0+ io_uring as new backend

This alpha release adds initial (still to be further optimized) io_uring support in uWS. It is still very incomplete, but EchoServer, HelloWorld and even HelloWorldThreaded work. As do load_test and http_load_test and possibly other examples.

Here's a comparison against the (minimal) fastwebsockets project, and against uWS v20. We still have a bunch of optimizations to add, zero-copy for instance.

You can build it with LDFLAGS=/usr/lib/liburing.a WITH_IO_URING=1 make

• Adds the Autobahn|Testsuite as an automatic test run by GitHub Actions, rather than manually.
• A WebSocket parser benchmark has been added.
• A few optimizations to the WebSocketProtocol.h.

Fixes an edge case where URI querystrings with keys with no value gets interpreted as invalid querystring.

Now the querystring "?one=&two=hello%20world" is considered valid, and HttpRequest.getQuery("two") will return "hello world" like it should.

This release also adds testing for the above case.

• Fixes a bug introduced in the bug fix of v20.38.0 🥇
• Adds new fuzz target for involved functionality

Fixes an edge case where calling HttpResponse::upgrade inside HttpResponse::cork from inside a third-party callback would crash.

Full Changelog: https://github.com/uNetworking/uWebSockets/compare/v20.37.0...v20.38.0

What's Changed

• rename capi uws_req_set_field -> uws_req_set_yield by @blackmius in https://github.com/uNetworking/uWebSockets/pull/1561
• Fix some typos by @haberbyte in https://github.com/uNetworking/uWebSockets/pull/1570
• Fix [-Werror=format-truncation] compiler warning by @mtrenkmann in https://github.com/uNetworking/uWebSockets/pull/1575
• fix(CAPI) uws_res_upgrade, uws_res_override_write_offset, feat(CAPI) uws_res_close and subscription events by @cirospaciari in https://github.com/uNetworking/uWebSockets/pull/1571
• Add uws_loop_defer function to uWebsockets CAPI by @GenrikhFetischev in https://github.com/uNetworking/uWebSockets/pull/1579
• Fix reported content length for HttpResponse::endWithoutBody by @atimin in https://github.com/uNetworking/uWebSockets/pull/1557
• Fix chunked body handling in fallback routine by @webcarrot in https://github.com/uNetworking/uWebSockets/pull/1585

New Contributors

• @blackmius made their first contribution in https://github.com/uNetworking/uWebSockets/pull/1561
• @haberbyte made their first contribution in https://github.com/uNetworking/uWebSockets/pull/1570
• @mtrenkmann made their first contribution in https://github.com/uNetworking/uWebSockets/pull/1575
• @GenrikhFetischev made their first contribution in https://github.com/uNetworking/uWebSockets/pull/1579
• @atimin made their first contribution in https://github.com/uNetworking/uWebSockets/pull/1557
• @webcarrot made their first contribution in https://github.com/uNetworking/uWebSockets/pull/1585

Full Changelog: https://github.com/uNetworking/uWebSockets/compare/v20.36.0...v20.37.0

• Yet more fixes to subscription events

Easy shutdown with App.close()

Calling this new function will:

• Close and invalidate all open listen sockets.
• Force close all open connections (both HTTP and WebSockets), calling their respective callbacks as needed (.onAborted, .close, .subscription).

This call can be used to gracefully close and release an App that needs maintenance.

Rebalancing with maxLifetime

A reworked timeout system now allows two lightweight timeout settings for WebSockets; idleTimeout (up to 16 minutes) and maxLifetime (up to 4 hours):

• idleTimeout is how long (in seconds) a WebSocket may be idle (have no traffic) before it is considered closed.
• maxLifetime is how long (in minutes) a WebSocket may be connected, before being gracefully closed by the server.

Specifying a value of 0 disables respective feature (the default for maxLifetime).

Why use maxLifetime?

The idea here is to enforce a partial rebalancing, constantly forcing a few connections to reconnect via whatever load balancer in use. This is a strategy used by Netflix where they found success in having maxLifetime = 30 minutes.

Good values for the settings should be somewhere around 30-120 seconds idleTimeout and 30-120 minutes maxLifetime.

Subscription events

A new kind of event has been added. Whenever a WebSocket::subscribe or WebSocket::unsubscribe call is made, or when implicit unsubscription happens (such as when a WebSocket has subscriptions and gets closed in any way), a subscription event will fire with:

• the WebSocket involved
• the topic name
• the new number of subscribers to this topic
• the former number of subscribers to this topic

These events can be used to easily manage external subscriptions such as when using Redis to orchestrate multiple instances of uWS. Whenever a subscription event with new subscription count == 1; you can create the corresponding Redis subscription. Whenever a subscription event with new subscription count == 0; you can free the corresponding Redis subscription.

• Don't use strftime for Date header (it depends on locale)

• Fixes undefined behavior introduced in v20.28.0

Hooking up Windows testing

• GitHub Actions now builds and runs the unit tests and smoke test on Windows on every push.
• The server was entirely broken on Windows, since the changes in v20.28.0 which is now fixed thanks to @rehans

More RFC 9112 (HTTP/1.1) compliance fixups

• Field names are now restricted to alphanumeric + hyphen
• Chunked encoding parsing now properly rejects too large chunks
• Chunked encoding now rejects non-hex chunk size and handles A-F, a-f, 0-9 properly
• The Host field has to be present, but is allowed to have empty value
• Field values are trimmed both front and back, by SP and HTAB only
• Request method is now case sensitive and getCaseSensitiveMethod() has been added
• getMethod() will continue to return lower cased for backwards compatibility until v21.

Performance regression testing

• Performance comparison against the v20.0.0 release shows there is no performance drift. We haven't lost any measurable performance by improving spec. compliance.

Smoke testing on CI

• There is a new smoke test that makes a bunch of different fetch() requests in keep-alive using Deno, checking CRC32 hashes for correctness both for chunked encoding and for fixed length bodies. This test runs on CI automatically on every push along the unit tests. It will be extended with more request types in the near future.

Initial C-API

Contributed by Ciro Spaciari (@cirospaciari) - there is now a quite complete C API that can be used from Zig, Rust and the like. Some form of this C API is already in use by Bun.

RFC 9112 (HTTP/1.1) compliance fixup

HTTP/1.1 has been around since late stone age and there is now a new RFC9112 that updates it further, released this very summer. This is a good time to go over said spec. and make uWS as compliant as practically possible. This is going to be a gradual shift over time, making uWS more strict in this area, but here are some of the fixes in this release:

• HTTP/1.0 requests are no longer accepted (so long Apache Bench!).
• Content-Length and Transfer-Encoding are now more strictly and correctly parsed and used.
• Requests without "host" header are dropped.
• Requests with both Content-Length and Transfer-Encoding are dropped.
• Requests with ridiculously large Content-Length are dropped.
• Header values can no longer contain invisible control bytes (ASCII below 32), except for HTAB.
• We are more strict in dropping requests with space between header key and colon.

Some of these fixes are due to a report by FFRI Security, Inc. If you consider spec. compliance a security factor; then update to latest uWS.

Yet more Transfer-Encoding: chunked fixes

• Keep-alive for chunked bodies was broken due to expecting an empty trailer which simply isn't there.