After a year of development, a new stable branch of the high-performance HTTP server and multiprotocol proxy server nginx 1.20.0 has been released, incorporating changes accumulated in the main branch 1.19.x. Going forward, all changes in the stable branch 1.20 will focus on fixing serious bugs and vulnerabilities. Soon, the main branch nginx 1.21 will be formed, where the development of new features will continue. For regular users who do not need to ensure compatibility with third-party modules, it is recommended to use the main branch, based on which commercial product releases of Nginx Plus are generated every three months.
According to March's report from Netcraft, nginx is used on 20.15% of all active websites (compared to 19.56% a year ago and 20.73% two years ago), ranking second in popularity in this category (Apache's share stands at 25.38% (down from 27.64% a year ago), Google at 10.09%, and Cloudflare at 8.51%). When considering all websites, nginx maintains its leadership with a 35.34% market share (down from 36.91% a year ago and 27.52% two years ago), while Apache's share stands at 25.98%, OpenResty (platform based on nginx and LuaJIT) at 6.55%, and Microsoft IIS at 5.96%.
Among the million most visited websites worldwide, nginx accounts for 25.55% (up from 25.54% a year ago and down from 26.22% two years ago). Currently, approximately 419 million sites are operated by nginx (down from 459 million a year ago). According to W3Techs, nginx is used on 33.7% of the million most visited sites, compared to 31.9% in April of last year and 41.8% the year before that (the decline is attributed to separate accounting for Cloudflare's HTTP server). Apache's share fell from 39.5% to 34% over the year, while Microsoft IIS dropped from 8.3% to 7%. The share of LiteSpeed rose from 6.3% to 8.4%, and Node.js increased from 0.8% to 1.2%. In Russia, nginx is used on 79.1% of the most visited sites (up from 78.9% a year ago).
The most notable improvements added during the formation of the main branch 1.19.x include:
- The ability to verify client certificates using external services based on the OCSP (Online Certificate Status Protocol). To enable verification, the ssl_ocsp directive is provided, to configure the cache size â ssl_ocsp_cache, and to override the OCSP handler URL specified in the certificate â ssl_ocsp_responder.
- The module ngx_stream_set_module has been included, allowing the assignment of a variable value. server { listen 12345; set $true 1; }
- A new directive proxy_cookie_flags has been added to specify flags for cookies in proxied connections. For example, to add the flag 'httponly' to cookie 'one', and the flags 'nosecure' and 'samesite=strict' to all other cookies, you can use the following: proxy_cookie_flags one httponly; proxy_cookie_flags ~ nosecure samesite=strict;
A similar directive userid_flags for adding flags to cookies is also implemented for the module ngx_http_userid.
- Directives 'ssl_conf_command', 'proxy_ssl_conf_command', 'grpc_ssl_conf_command', and 'uwsgi_ssl_conf_command' have been added, through which you can set arbitrary parameters for configuring OpenSSL. For example, to prioritize ChaCha ciphers and extend the configuration of TLSv1.3 ciphers, you can specify ssl_conf_command Options PrioritizeChaCha; ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256;
- The directive 'ssl_reject_handshake' has been added, which mandates the rejection of all handshake attempts. SSL-connections (for example, it can be used to reject all requests with unknown hostnames in the SNI field). server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name example.com; ssl_certificate example.com.crt; ssl_certificate_key example.com.key; }
- The mail proxy has added the directive proxy_smtp_auth, which allows authenticating the user on the backend using the AUTH command and the PLAIN SASL mechanism.
- The directive 'keepalive_time' has been added, which limits the total lifespan of each keep-alive connection, after which the connection will be closed (do not confuse it with keepalive_timeout, which defines the inactivity duration after which the keep-alive connection closes).
- A new variable $connection_time has been added, through which you can obtain information about the connection duration in seconds with millisecond precision.
- The directives 'proxy_cache_path', 'fastcgi_cache_path', 'scgi_cache_path', and 'uwsgi_cache_path' have been supplemented with the parameter 'min_free', which regulates the cache size based on the minimum available disk space.
- The directives 'lingering_close', 'lingering_time', and 'lingering_timeout' have been adapted for use with HTTP/2.
- The connection handling code in HTTP/2 is similar to that of HTTP/1.x. Support for individual settings âhttp2_recv_timeoutâ, âhttp2_idle_timeoutâ, and âhttp2_max_requestsâ has been deprecated in favor of the general directives âkeepalive_timeoutâ and âkeepalive_requestsâ. The settings âhttp2_max_field_sizeâ and âhttp2_max_header_sizeâ have been removed, and instead, âlarge_client_header_buffersâ should be used.
- A new command line option â-eâ has been added, allowing you to specify an alternative file for error log recording, which will be used instead of the log defined in the settings. Instead of a file name, you can specify the special value stderr.
Source: opennet.ru
