aboutsummaryrefslogtreecommitdiffstats
path: root/doc
AgeCommit message (Collapse)Author
2021-05-12Cowboy 2.9.02.9.0Loïc Hoguin
2021-04-24Two more HTTP specsLoïc Hoguin
2020-11-27AcceptCallback may now return created/see_other tuples for POSTMartin Björklund
They replace and deprecate the {true,URI} return value.
2020-11-27Graceful shutdownViktor Söderqvist
Note: This commit makes cowboy depend on cowlib master. Graceful shutdown for HTTP/2: 1. A GOAWAY frame with the last stream id set to 2^31-1 is sent and a timer is started (goaway_initial_timeout, default 1000ms), to wait for any in-flight requests sent by the client, and the status is set to 'closing_initiated'. If the client responds with GOAWAY and closes the connection, we're done. 2. A second GOAWAY frame is sent with the actual last stream id and the status is set to 'closing'. If no streams exist, the connection terminates. Otherwise a second timer (goaway_complete_timeout, default 3000ms) is started, to wait for the streams to complete. New streams are not accepted when status is 'closing'. 3. If all streams haven't completed after the second timeout, the connection is forcefully terminated. Graceful shutdown for HTTP/1.x: 1. If a request is currently being handled, it is waited for and the response is sent back to the client with the header "Connection: close". Then, the connection is closed. 2. If the current request handler is not finished within the time configured in transport option 'shutdown' (default 5000ms), the connection process is killed by its supervisor (ranch). Implemented for HTTP/1.x and HTTP/2 in the following scenarios: * When receiving exit signal 'shutdown' from the supervisor (e.g. when cowboy:stop_listener/3 is called). * When a connection process is requested to terminate using sys:terminate/2,3. LH: Edited tests a bit and added todos for useful tests to add.
2020-08-19Minor grammar correctionsThomas Sciaroni
Verb agreement error "The request process executes middlewares which, by default, including the router and then the execution of handlers." -> "The request process executes middlewares. By default, the request process executes the router and then the handlers." Adverbial clause at beginning of sentence needs comma "By default Cowboy comes..." -> "By default, Cowboy comes..."
2020-07-01Tweak a sentence in the guideLoïc Hoguin
Thanks Tamir Halperin for pointing this out. [skip ci]
2020-05-28Fix the cowboy_req:inform/3 example in the manualLoïc Hoguin
2020-05-21Cowboy 2.8.0Loïc Hoguin
2020-05-20Increase the default max_keepalive HTTP option to 1000Loïc Hoguin
100 is very low for current deployments. 1000 is more appropriate as a default value.
2020-05-20Clarify the routing algorithmLoïc Hoguin
2020-04-08Document the HTTP/2 linger_timeout optionLoïc Hoguin
2020-04-08Clarify that protocol opts may be defined by stream handlersLoïc Hoguin
2020-03-30Add more headers to cowboy_req:parse_header/2,3Loïc Hoguin
2020-03-29Increase the default max_received_frame_rateLoïc Hoguin
Allow 10000 frames every 10 seconds instead of just 1000, as the limit was too quickly reached in some deployments.
2020-03-29Add more specificationsLoïc Hoguin
2020-02-08Add Trace Context to the list of specsLoïc Hoguin
2020-02-08Clarify modifying/adding to the Req objectLoïc Hoguin
2020-01-06Fix cowboy_req:parse_header manual for unknown headersLoïc Hoguin
2020-01-06Add a skeleton performance chapter to the guideLoïc Hoguin
2020-01-06Use active,NLoïc Hoguin
This reduces the number of times we need to ask for more packets, and as a result we get a fairly large boost in performance, especially with HTTP/1.1. Unfortunately this makes Cowboy require at least Erlang/OTP 21.3+ because the ssl application did not have active,N. For simplicity the version required will be Erlang/OTP 22+. In addition this change improves hibernate handling in cowboy_websocket. Hibernate will now work for HTTP/2 transport as well, and stray or unrelated messages will no longer cancel hibernate (the process will handle the message and go back into hibernation). Thanks go to Stressgrid for benchmarking an early version of this commit: https://stressgrid.com/blog/cowboy_performance_part_2/
2019-12-31No longer use erlang:get_stacktrace/0Loïc Hoguin
It has been deprecated in OTP and the new way is available on all supported OTP versions.
2019-12-31Add new RFCs to the listLoïc Hoguin
2019-10-10Cowboy 2.7.0Loïc Hoguin
2019-10-10Fix a number of low hanging todosLoïc Hoguin
2019-10-10Add shutdown_reason Websocket commandLoïc Hoguin
This allows changing the normal exit reason of Websocket processes, providing a way to signal other processes of why the exit occurred.
2019-10-09Implement flow control for HTTP/1.1Loïc Hoguin
We now stop reading from the socket unless asked to, when we reach the request body. The option initial_stream_flow_size controls how much data we read without being asked, as an optimization. We may also have received additional data along with the request headers. This commit also reworks the timeout handling for HTTP/1.1 because the stray timeout message was easily reproducible after implementing the flow control. The issue should be gone for good this time.
2019-10-07Add migration guide for Cowboy 2.7Loïc Hoguin
2019-10-07Add new stream handlers to the guideLoïc Hoguin
Also link from the guide to manual pages.
2019-10-07Document no date/server headers from response/headers commandsLoïc Hoguin
2019-10-07Add cowboy_req:cast/2Loïc Hoguin
Better than sending messages manually.
2019-10-07Document the set_options stream handler commandLoïc Hoguin
2019-10-07Document the log stream handler commandLoïc Hoguin
2019-10-07Document the logger optionLoïc Hoguin
2019-10-07Document cowboy_tracer_hLoïc Hoguin
2019-10-07Document cowboy_metrics_hLoïc Hoguin
2019-10-06Document the commands based Websocket interfaceLoïc Hoguin
The old interface with ok|reply|stop tuples is deprecated.
2019-10-06Fix PUT when resource doesn't exist in flowchartLoïc Hoguin
This required moving around a lot of things so hopefully I did not add errors while doing so. Only time will tell. Also add the 415 that can result from content_types_accepted.
2019-10-06Document how to recover from cookie parsing errorsLoïc Hoguin
2019-10-05Add Websocket option validate_utf8Loïc Hoguin
This allows disabling the UTF-8 validation check for text and close frames.
2019-10-05Fix REST flowchart around 201 response for PUTLoïc Hoguin
When the method is PUT we do not check the location header.
2019-10-05Add cowboy_req:filter_cookies/2Loïc Hoguin
2019-10-03Document media type wildcard in content_types_acceptedLoïc Hoguin
2019-10-03Document stopping the listener in App:stop/1Loïc Hoguin
2019-10-02Fix HTTP/2 CVEsLoïc Hoguin
A number of HTTP/2 CVEs were documented recently: https://www.kb.cert.org/vuls/id/605641/ This commit, along with a few changes and additions in Cowlib, fix or improve protection against all of them. For CVE-2019-9511, also known as Data Dribble, the new option stream_window_data_threshold can be used to control how little the DATA frames that Cowboy sends can get. For CVE-2019-9516, also known as 0-Length Headers Leak, Cowboy will now simply reject streams containing 0-length header names. For CVE-2019-9517, also known as Internal Data Buffering, the backpressure changes were already pretty good at preventing this issue, but a new option max_connection_buffer_size was added for even better control over how much memory we are willing to allocate. For CVE-2019-9512, also known as Ping Flood; CVE-2019-9515, also known as Settings Flood; CVE-2019-9518, also known as Empty Frame Flooding; and similar undocumented scenarios, a frame rate limiting mechanism was added. By default Cowboy will now allow 1000 frames every 10 seconds. This can be configured via max_received_frame_rate. For CVE-2019-9514, also known as Reset Flood, another rate limiting mechanism was added and can be configured via max_reset_stream_rate. By default Cowboy will do up to 10 stream resets every 10 seconds. Finally, nothing was done for CVE-2019-9513, also known as Resource Loop, because Cowboy does not currently implement the HTTP/2 priority mechanism (in parts because these issues were well known from the start). Tests were added for all cases except Internal Data Buffering, which I'm not sure how to test, and Resource Loop, which is not currently relevant.
2019-09-28Add persistent_term support to the routerLoïc Hoguin
2019-09-14Implement backpressure on cowboy_req:stream_bodyLoïc Hoguin
This should limit the amount of memory that Cowboy is using when a handler is sending data much faster than the network. The new max_stream_buffer_size is a soft limit and only has an effect when the cowboy_stream_h handler is used.
2019-09-06Fix using custom fields in ReqLoïc Hoguin
2019-09-06Document unit for options that are in bytesLoïc Hoguin
2019-09-05Minor grammar correctionAlastair Hole
Noun 'setup' -> verb phrase 'set up'
2019-09-05Fix and optimize sending of WINDOW_UPDATE framesLoïc Hoguin
For long-running connections it was possible for the connection window to become larger than allowed by the protocol because the window increases claimed by stream handlers were never reclaimed even if no data was consumed. The new code applies heuristics to fix this and reduce the number of WINDOW_UPDATE frames that are sent. It includes six new options to control that behavior: margin, max and threshold for both the connection and stream windows. The margin is some extra space added on top of the requested read size. The max is the maximum window size at any given time. The threshold is a minimum window size that must be reached before we even consider sending more WINDOW_UPDATE frames. We also avoid sending WINDOW_UPDATE frames when there is already enough space in the window, or when the read size is 0. Cowlib is set to master until a new tag is done.
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-15 04:57:52 +0000