Hiawatha (web server)

Web server

(Learn how and when to remove this message)

Hiawatha Webserver

Original author(s)	Hugo Leisink
Developer(s)	Hugo Leisink
Initial release	2002; 22 years ago (2002)

Stable release	11.5^[1] / 23 October 2023

Repository	gitlab.com/hsleisink/hiawatha
Written in	C^[2]
Operating system	FreeBSD, Haiku os, HP-UX, IBM AIX, Linux, OpenBSD, OS X, QNX, Solaris, Unix-like and Windows^[3]
Platform	POSIX, Cross-platform
Available in	English
Type	Web server
License	GPL-2.0-only
Website	hiawatha.leisink.net.

Hiawatha was a free and open source cross-platform web server developed by Hugo Leisink.^[4]

History

Hiawatha development began in January 2002 as a web server. Leisink, a computer science student at the time, initially created the server to support internet servers based in student houses in South Holland and the Netherlands. The web server was designed with security as its focus.

The January 2009 edition of Linux Magazine included an article on the Hiawatha web server, describing it as "a light web server with good performance and some innovative security functions".^[5] In 2015 Hiawatha was cited as a lightweight alternative to Apache, as it prioritized the installation experience and reduced storage over adding other features.^[6]^[7]^[8]

In February 2019 Leisink announced the end of major development.^[9] Releases since have focused on fixing bugs, and keeping components up to date.^[10]

Major version history

1.0: September 2002. A basic but functional web server.
2.0: March 2004. Use of multithreading instead of forking.
3.0: September 2004. SSL support.
4.0: December 2005. A CGI-wrapper^[11] for improved security was included.
5.0: October 2006. FastCGI support for improved CGI speed.
5.2: November 2006. First-time integration to the FreeBSD Ports system at version 5.2 in December 2006,^[12] to the OpenBSD ports tree at version 5.7 in March 2007.^[13]
5.12: August 2007. URL rewriting support.
6.0: October 2007. IPv6 support.
6.6: April 2008. XSLT support.
6.10: October 2008. Prevent cross-site request forgery added.
7.0: February 2010. Remote monitoring support.
8.0: January 2012. Autoconf replaced with CMake, OpenSSL replaced with PolarSSL.
9.0: March 2013. Clients handled via thread pool instead of creating threads on the fly.
10.0: November 2015. Streamlined handling of Directory sections in server configuration.
10.9: February 2019. Last major developed release.
11.0: July 2021, mbed TLS library updated to v3.0.0.

In February 2019, Leisink announced the release of version 10.9 and the end of major development in blog posts.^[9] As of December 2023, Leisink continued to publish bug fixes and small improvement releases.^[10]

Features

The Hiawatha web server featured:

CGI and load balancing FastCGI support
Reverse proxy functionality
Chroot support
URL toolkit which supports URL rewriting
SSL and TLS support
Basic and digest HTTP authentication
Upload speed control by traffic shaping
Internal file caching
IPv6 support
HTTP compression using gzip
Virtual hosting
Support for WebDAV applications
Support for Server Name Indication (added in v8.6)

Hiawatha aimed to prevent SQL-injection, cross-site scripting (XSS), Cross-site request forgery (CSRF), and denial-of-service attacks. It allowed banning of potential hackers and had an option to limit the runtime of CGI applications.^[14] RFC3546 support was included with version 8.6, which was developed with PolarSSLv1.2.

Performance

In 2012 a performance test was carried out by an independent researcher (SaltwaterC). It found that Hiawatha was faster than ten other servers with Drupal static content, while performing comparably to the rest in other metrics.^[15]

Hiawatha supported load-balanced FastCGI and supported the PHP project's FastCGI Process Manager (PHP-FPM)).^[16]

References

^ "v11.5 · Tags · Hugo Leisink / Hiawatha web server · GitLab".
^ "Hiawatha - Ohloh". Ohloh.net. Archived from the original on 21 December 2013. Retrieved 12 April 2013.
^ Hiawatha on Haiku OS
^ Leisink, Hugo. "Hiawatha About Page". Retrieved 22 January 2015.
^ Schürmann, Tim. "Safe Passage » Linux Magazine". Linux Magazine. Retrieved 2021-01-19.
^ Wadge, Chris. "Why I Use the Hiawatha Webserver". Dotbalm.org. Archived from the original on 23 January 2015. Retrieved 23 January 2015.
^ Vaughan-Nichols, Steven J. "Picking the Right Web Server for the Right Job". SmartBear. Retrieved 23 January 2015.
^ Lavigne, Dru. "Hiawatha Web Server". Toolbox.com. Archived from the original on 18 July 2014. Retrieved 23 January 2015.
^ ^a ^b Leisink, Hugo. "Hiawatha webserver". www.hiawatha-webserver.org. Retrieved 2023-08-04.
^ ^a ^b Leisink, Hugo (2023-10-13). "Hiawatha Changelog". Hiawatha Webserver. Retrieved 2024-01-16.
^ Manual page cgi-wrapper - Hiawatha webserverArchived 2012-10-19 at the Wayback Machine
^ "FreshPorts -- www/hiawatha: Advanced and secure webserver for Unix". www.freshports.org. Retrieved 2021-01-19.
^ "OpenPorts.se | The OpenBSD package collection". openports.se. Archived from the original on 2021-02-25. Retrieved 2021-01-19.
^ Leisink, Hugo (13 December 2023). "Features". Hiawatha webserver. Retrieved 13 December 2023.
^ PHP_web_serving_studyArchived 2012-04-26 at the Wayback Machine
^ Leisink, Hugo. "Hiawatha webserver". www.hiawatha-webserver.org. Retrieved 2021-01-18.

External links

Official website
Lavigne, Dru (December 29, 2006). "Hiawatha Web Server". IT Toolbox. Archived from the original on July 18, 2014. Retrieved June 29, 2010. (Unix blog)
Schürmann, Tim (January 2009). "Der sichere Webserver Hiawatha" [The secure Web server Hiawatha]. Linux (in German). Admin Magazine. Archived from the original on 2016-03-04. Retrieved 2014-06-27.