<feed xmlns='http://www.w3.org/2005/Atom'>
<title>cowboy.git/doc/src/manual, branch master</title>
<subtitle>Small, fast, modern HTTP server for Erlang/OTP.
</subtitle>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/'/>
<entry>
<title>HTTP/1: Allow independent max authorization/cookie length</title>
<updated>2025-10-14T10:02:51+00:00</updated>
<author>
<name>Marko Mindek</name>
<email>marko.mindek@gmail.com</email>
</author>
<published>2025-10-10T22:10:03+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=802858b331f464b4e72830d1dcdcb2d22e96b440'/>
<id>802858b331f464b4e72830d1dcdcb2d22e96b440</id>
<content type='text'>
Adds two options:

 * max_authorization_header_value_length to configure the
   maximum length of the authorization header specifically;

 * max_cookie_header_value_length to configure the
   maximum length of the cookie header specifically.

LH: I added the relevant tests.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Adds two options:

 * max_authorization_header_value_length to configure the
   maximum length of the authorization header specifically;

 * max_cookie_header_value_length to configure the
   maximum length of the cookie header specifically.

LH: I added the relevant tests.
</pre>
</div>
</content>
</entry>
<entry>
<title>cowboy_rest: Allow last_modified to return undefined</title>
<updated>2025-09-17T13:10:16+00:00</updated>
<author>
<name>Thomas Arts</name>
<email>thomas.arts@quviq.com</email>
</author>
<published>2025-08-28T05:49:07+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=b7b5dc929dd5908e38b1a1df9e9dc4df1e485f2b'/>
<id>b7b5dc929dd5908e38b1a1df9e9dc4df1e485f2b</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>New data delivery mechanism for HTTP/2+ Websocket</title>
<updated>2025-09-15T11:09:23+00:00</updated>
<author>
<name>Loïc Hoguin</name>
<email>essen@ninenines.eu</email>
</author>
<published>2025-08-21T16:09:42+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=8da6ca11e8ea4e93def78bd0299decd6f409bc43'/>
<id>8da6ca11e8ea4e93def78bd0299decd6f409bc43</id>
<content type='text'>
A new data_delivery mechanism called 'relay' has been added.
It bypasses stream handlers (and the buffering in cowboy_stream_h)
and sends the data directly to the process implementing
Websocket (and should work for other similar protocols
like HTTP/2 WebTransport).

Flow control in HTTP/2 is maintained in a simpler way,
via a configured flow value that is used to maintain
the window to a reasonable value when data is received.

The 'relay' data_delivery has been implemented for both
HTTP/2 and HTTP/3. It has not been implemented for HTTP/1.1
since switching protocol there overrides the connection process.

HTTP/2 Websocket is now better tested.

A bug was fixed with the 'stream_handlers' data_delivery
where active mode would not be reenabled if it was disabled
at some point.

The Websocket performance suite has been updated to
include tests that do not use Gun. Websocket modules
used by the performance suite use the 'relay' data_delivery
now. Performance is improved significantly with 'relay',
between 10% and 20% faster. HTTP/2 Websocket performance
is not on par with HTTP/1.1 still, but the remaining
difference is thought to be from the HTTP/2 overhead and
flow control.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
A new data_delivery mechanism called 'relay' has been added.
It bypasses stream handlers (and the buffering in cowboy_stream_h)
and sends the data directly to the process implementing
Websocket (and should work for other similar protocols
like HTTP/2 WebTransport).

Flow control in HTTP/2 is maintained in a simpler way,
via a configured flow value that is used to maintain
the window to a reasonable value when data is received.

The 'relay' data_delivery has been implemented for both
HTTP/2 and HTTP/3. It has not been implemented for HTTP/1.1
since switching protocol there overrides the connection process.

HTTP/2 Websocket is now better tested.

A bug was fixed with the 'stream_handlers' data_delivery
where active mode would not be reenabled if it was disabled
at some point.

The Websocket performance suite has been updated to
include tests that do not use Gun. Websocket modules
used by the performance suite use the 'relay' data_delivery
now. Performance is improved significantly with 'relay',
between 10% and 20% faster. HTTP/2 Websocket performance
is not on par with HTTP/1.1 still, but the remaining
difference is thought to be from the HTTP/2 overhead and
flow control.
</pre>
</div>
</content>
</entry>
<entry>
<title>Add support for lists in cowboy_req:set_resp_headers</title>
<updated>2025-02-11T12:28:45+00:00</updated>
<author>
<name>Loïc Hoguin</name>
<email>essen@ninenines.eu</email>
</author>
<published>2025-02-11T11:00:03+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=e8a1868033a75fa1f684a8b91ff7aa25e6c67676'/>
<id>e8a1868033a75fa1f684a8b91ff7aa25e6c67676</id>
<content type='text'>
This is meant to be used with clients such as Gun to simplify
proxying and similar operations. The set-cookie header must
not be set this way so there is still some extra processing
to be done to fully translate a Gun response into a Cowboy
response.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This is meant to be used with clients such as Gun to simplify
proxying and similar operations. The set-cookie header must
not be set this way so there is still some extra processing
to be done to fully translate a Gun response into a Cowboy
response.
</pre>
</div>
</content>
</entry>
<entry>
<title>Provide better control over which HTTP protocols are enabled</title>
<updated>2025-02-10T14:26:00+00:00</updated>
<author>
<name>Loïc Hoguin</name>
<email>essen@ninenines.eu</email>
</author>
<published>2025-02-10T14:26:00+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=053e233c5634ede60dec6c2c261a5729dae1abc4'/>
<id>053e233c5634ede60dec6c2c261a5729dae1abc4</id>
<content type='text'>
Over cleartext TCP the `protocols` option lists the enabled
protocols. The default is to allow both HTTP/1.1 and HTTP/2.

Over TLS the default protocol to use when ALPN is not used
can now be configured via the `alpn_default_protocol` option.

Performing an HTTP/1.1 upgrade to HTTP/2 over TLS is now
rejected with an error as connecting to HTTP/2 over TLS
requires the use of ALPN (or that HTTP/2 be the default
when connecting over TLS).
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Over cleartext TCP the `protocols` option lists the enabled
protocols. The default is to allow both HTTP/1.1 and HTTP/2.

Over TLS the default protocol to use when ALPN is not used
can now be configured via the `alpn_default_protocol` option.

Performing an HTTP/1.1 upgrade to HTTP/2 over TLS is now
rejected with an error as connecting to HTTP/2 over TLS
requires the use of ALPN (or that HTTP/2 be the default
when connecting over TLS).
</pre>
</div>
</content>
</entry>
<entry>
<title>Deprecate the inactivity_timeout options</title>
<updated>2025-02-07T16:59:44+00:00</updated>
<author>
<name>Loïc Hoguin</name>
<email>essen@ninenines.eu</email>
</author>
<published>2025-02-07T16:02:07+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=cc97c770fbe6484b56e661021c4350163349a740'/>
<id>cc97c770fbe6484b56e661021c4350163349a740</id>
<content type='text'>
When idle_timeout is configured we do not need a separate
timer to detect inactivity. Disabling idle_timeout is not
recommended and should not be necessary.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When idle_timeout is configured we do not need a separate
timer to detect inactivity. Disabling idle_timeout is not
recommended and should not be necessary.
</pre>
</div>
</content>
</entry>
<entry>
<title>Add hibernate option to cowboy_http and cowboy_http2</title>
<updated>2025-02-07T16:59:44+00:00</updated>
<author>
<name>Loïc Hoguin</name>
<email>essen@ninenines.eu</email>
</author>
<published>2025-02-07T15:57:58+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=0f257d06b6a4b1170621af66e9b54addf4d8e954'/>
<id>0f257d06b6a4b1170621af66e9b54addf4d8e954</id>
<content type='text'>
When enabled the connection process will automatically hibernate.
Because hibernation triggers GC, this can be used as a way to
keep memory usage lower, at the cost of performance.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When enabled the connection process will automatically hibernate.
Because hibernation triggers GC, this can be used as a way to
keep memory usage lower, at the cost of performance.
</pre>
</div>
</content>
</entry>
<entry>
<title>Lower the lower dynamic buffer value to 1024</title>
<updated>2025-02-05T15:22:06+00:00</updated>
<author>
<name>Loïc Hoguin</name>
<email>essen@ninenines.eu</email>
</author>
<published>2025-02-05T15:22:06+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=9d4912208e91c1cb3195bf86966a84e88e7c9ff9'/>
<id>9d4912208e91c1cb3195bf86966a84e88e7c9ff9</id>
<content type='text'>
There's not a big performance difference between 8192 and 1024
so let's use less memory at the start of the connection.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There's not a big performance difference between 8192 and 1024
so let's use less memory at the start of the connection.
</pre>
</div>
</content>
</entry>
<entry>
<title>Implement dynamic socket buffer sizes</title>
<updated>2025-02-05T13:29:58+00:00</updated>
<author>
<name>Loïc Hoguin</name>
<email>essen@ninenines.eu</email>
</author>
<published>2025-02-03T14:36:16+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=49be0f57cf5ce66178dc24b9c08c835888d1ce0e'/>
<id>49be0f57cf5ce66178dc24b9c08c835888d1ce0e</id>
<content type='text'>
Cowboy will set the socket's buffer size dynamically to
better fit the current workload. When the incoming data
is small, a low buffer size reduces the memory footprint
and improves responsiveness and therefore performance.
When the incoming data is large, such as large HTTP
request bodies, a larger buffer size helps us avoid
doing too many binary appends and related allocations.

Setting a large buffer size for all use cases is
sub-optimal because allocating more than needed
necessarily results in a performance hit (not just
increased memory usage).

By default Cowboy starts with a buffer size of 8192 bytes.
It then doubles or halves the buffer size depending on
the size of the data it receives from the socket. It
stops decreasing at 8192 and increasing at 131072 by
default.

To keep track of the size of the incoming data Cowboy
maintains a moving average. It allows Cowboy to avoid
changing the buffer too often but still react quickly
when necessary. Cowboy will increase the buffer size
when the moving average is above 90% of the current
buffer size, and decrease when the moving average is
below 40% of the current buffer size.

The current buffer size and moving average are
propagated when switching protocols. The dynamic buffer
is implemented in HTTP/1, HTTP/2 and HTTP/1 Websocket.
HTTP/2 Websocket has it disabled because it doesn't
interact directly with the socket; in that case it
is HTTP/2 that has a dynamic buffer.

The dynamic buffer provides a very large performance improvement
in many scenarios, at minimal cost for others. Because it largely
depend on the underlying protocol the improvements are no all equal.
TLS and compression also impact the results.

The improvement when reading a large request body, with the
requests repeated in a fast loop are:

* HTTP: 6x to 20x faster
* HTTPS: 2x to 6x faster
* H2: 4x to 5x faster
* H2C: 20x to 40x faster

I am not sure why H2C's performance was so bad, especially compared
to H2, when using default buffer sizes. Dynamic buffers make H2C a
lot more viable with default settings.

The performance impact on "hello world" type requests is minimal,
it goes from -5% to +5% roughly.

Websocket improvements vary again depending on the protocol, but
also depending on whether compression is enabled:

* HTTP echo: roughly 2x faster
* HTTP send: roughly 4x faster
* H2C echo: roughly 2x faster
* H2C send: 3x to 4x faster

In the echo test we reply back, and Gun doesn't have the dynamic
buffer optimisation, so that probably explains the x2 difference.

With compression however there isn't much improvement. The results
are roughly within -10% to +10% of each other. Zlib compression
seems to be a bottleneck, or at least to modify the performance
profile to such an extent that the size of the buffer does not
matter. This happens to randomly generated binary data as well
so it is probably not caused by the test data.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Cowboy will set the socket's buffer size dynamically to
better fit the current workload. When the incoming data
is small, a low buffer size reduces the memory footprint
and improves responsiveness and therefore performance.
When the incoming data is large, such as large HTTP
request bodies, a larger buffer size helps us avoid
doing too many binary appends and related allocations.

Setting a large buffer size for all use cases is
sub-optimal because allocating more than needed
necessarily results in a performance hit (not just
increased memory usage).

By default Cowboy starts with a buffer size of 8192 bytes.
It then doubles or halves the buffer size depending on
the size of the data it receives from the socket. It
stops decreasing at 8192 and increasing at 131072 by
default.

To keep track of the size of the incoming data Cowboy
maintains a moving average. It allows Cowboy to avoid
changing the buffer too often but still react quickly
when necessary. Cowboy will increase the buffer size
when the moving average is above 90% of the current
buffer size, and decrease when the moving average is
below 40% of the current buffer size.

The current buffer size and moving average are
propagated when switching protocols. The dynamic buffer
is implemented in HTTP/1, HTTP/2 and HTTP/1 Websocket.
HTTP/2 Websocket has it disabled because it doesn't
interact directly with the socket; in that case it
is HTTP/2 that has a dynamic buffer.

The dynamic buffer provides a very large performance improvement
in many scenarios, at minimal cost for others. Because it largely
depend on the underlying protocol the improvements are no all equal.
TLS and compression also impact the results.

The improvement when reading a large request body, with the
requests repeated in a fast loop are:

* HTTP: 6x to 20x faster
* HTTPS: 2x to 6x faster
* H2: 4x to 5x faster
* H2C: 20x to 40x faster

I am not sure why H2C's performance was so bad, especially compared
to H2, when using default buffer sizes. Dynamic buffers make H2C a
lot more viable with default settings.

The performance impact on "hello world" type requests is minimal,
it goes from -5% to +5% roughly.

Websocket improvements vary again depending on the protocol, but
also depending on whether compression is enabled:

* HTTP echo: roughly 2x faster
* HTTP send: roughly 4x faster
* H2C echo: roughly 2x faster
* H2C send: 3x to 4x faster

In the echo test we reply back, and Gun doesn't have the dynamic
buffer optimisation, so that probably explains the x2 difference.

With compression however there isn't much improvement. The results
are roughly within -10% to +10% of each other. Zlib compression
seems to be a bottleneck, or at least to modify the performance
profile to such an extent that the size of the buffer does not
matter. This happens to randomly generated binary data as well
so it is probably not caused by the test data.
</pre>
</div>
</content>
</entry>
<entry>
<title>Websocket: Allow setting the max_frame_size option dynamically</title>
<updated>2025-01-16T13:47:20+00:00</updated>
<author>
<name>Loïc Hoguin</name>
<email>essen@ninenines.eu</email>
</author>
<published>2025-01-16T13:40:37+00:00</published>
<link rel='alternate' type='text/html' href='http://git.ninenines.eu/cowboy.git/commit/?id=81de580aeec405481cacb618a131fa895605004b'/>
<id>81de580aeec405481cacb618a131fa895605004b</id>
<content type='text'>
This can be used to limit the maximum frame size before
some authentication or other validation is completed.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This can be used to limit the maximum frame size before
some authentication or other validation is completed.
</pre>
</div>
</content>
</entry>
</feed>
