The release of the lightweight HTTP server lighttpd 1.4.65 has taken place, aiming to combine high performance, security, standards compliance, and flexibility in configuration. Lighttpd is suitable for use in high-traffic systems and is designed for low memory and CPU resource consumption. The new version features 173 changes. The project code is written in C and is distributed under the BSD license.
Key innovations:
- Support for WebSocket over HTTP/2 has been added, along with the implementation of RFC 8441, which describes a mechanism for initiating WebSocket connections within a single thread over HTTP/2.
- An extended priority management scheme has been implemented, allowing clients to influence the priority of transmitted proxy server responses (RFC 9218), as well as manage priorities when redirecting requests. HTTP/2 now supports the PRIORITY_UPDATE frame.
- The lighttpd.conf settings now support conditional matching bound to the start (=^) and end (=$) of the string. Such string checks are significantly faster than regular expressions and sufficient for many simple checks.
- In mod_webdav, support for partial PUT operations (covering part of the data via the Range header) has been added. You can enable this option using 'webdav.opts += («partial-put-copy-modify' => 'enable')'.
- In mod_accesslog, the option 'accesslog.escaping = 'json'' has been added.
- In mod_deflate, support for building with libdeflate has been added.
- The transfer of the request body over HTTP/2 has been accelerated.
- The default value of the server.max-keep-alive-requests parameter has been changed from 100 to 1000.
- In the list of MIME types, 'application/javascript' has been replaced with 'text/javascript' (RFC 9239).
In the future, stricter cipher settings for TLS will be applied and outdated ciphers will be disabled by default. The CipherString setting will change from 'HIGH' to 'EECDH+AESGCM:AES256+EECDH:CHACHA20:SHA256:!SHA384'. Additionally, deprecated TLS options will be scheduled for removal: .honor-cipher-order, ssl.dh-file, ssl.ec-curve, ssl.disable-client-renegotiation, ssl.use-sslv2, ssl.use-sslv3. Additionally, the cleanup of mini-modules, which can be replaced with a more flexible Lua implementation of mod_magnet, will continue. Specifically, the modules mod_evasive, mod_secdownload, mod_uploadprogress, and mod_usertrack are slated for removal. sslThe release of the lightweight HTTP server lighttpd 1.4.65 has taken place, aiming to combine high performance, security, standards compliance, and flexibility in configuration.
Source: opennet.ru
