FastCGI: 30 years old and still the better protocol for reverse proxies (agwa.name)

Article summary

The article discusses the use of FastCGI as a protocol for reverse proxies, highlighting its advantages over HTTP in terms of security and simplicity. FastCGI has been around for 30 years and is supported by popular proxies like Apache, Caddy, nginx, and HAProxy. The author argues that using HTTP for reverse proxying is a security risk due to its complexity and the potential for desync attacks. FastCGI provides a simpler and more secure alternative, with features like domain separation between headers from the client and information added by the proxy.

Main themes

• FastCGI vs HTTP
• Reverse proxying
• Security risks
• Protocol simplicity
• Web development

What commenters say

• Using HTTP for reverse proxying is a security risk due to its complexity and the potential for desync attacks, making FastCGI a better alternative.
• The End-to-End Principle does not apply in the context of connection caching and multiplexing, and using HTTP for reverse proxying can lead to security issues.
• FastCGI is not widely adopted due to the simplicity and ubiquity of HTTP, despite its security advantages.
• Embedding an HTTP server or FastCGI server in an application can simplify local development and maintenance, but may not be suitable for all use cases.
• The use of HTTP for reverse proxying is often justified by its simplicity and the fact that it is already needed to handle at the gateway, but this simplicity comes at the cost of security.
• FastCGI provides a safer and simpler alternative to HTTP for reverse proxying, as it removes the need for the application server to perform parsing of HTTP.
• The security benefits of FastCGI are not unique to the protocol, and other solutions like HTTP/2 can provide similar benefits, but FastCGI has been around for longer and is more established.