Updated README

Remove use of exceptions.

README.md

@@ -50,7 +50,16 @@ svr.listen_after_bind();
 ### Static File Server
 
 ```cpp
-svr.set_base_dir("./www");
+svr.set_base_dir("./www"); // This is same as `svr.set_base_dir("./www", "/")`;
+```
+
+```cpp
+svr.set_base_dir("./www", "/public");
+```
+
+```cpp
+svr.set_base_dir("./www1", "/public"); // 1st order
+svr.set_base_dir("./www2", "/public"); // 2nd order
 ```
 
 ### Logging
@@ -81,12 +90,12 @@ svr.Post("/multipart", [&](const auto& req, auto& res) {
     const auto& file = req.get_file_value("name1");
     // file.filename;
     // file.content_type;
-    auto body = req.body.substr(file.offset, file.length);
+    // file.content;
 });
 
 ```
 
-### Stream content with Content provider
+### Send content with Content provider
 
 ```cpp
 const uint64_t DATA_CHUNK_SIZE = 4;
@@ -104,6 +113,34 @@ svr.Get("/stream", [&](const Request &req, Response &res) {
 });
 ```
 
+### Receive content with Content receiver
+
+```cpp
+svr.Post("/content_receiver",
+  [&](const Request &req, Response &res, const ContentReader &content_reader) {
+    if (req.is_multipart_form_data()) {
+      MultipartFiles files;
+      content_reader(
+        [&](const std::string &name, const MultipartFile &file) {
+          files.emplace(name, file);
+          return true;
+        },
+        [&](const std::string &name, const char *data, size_t data_length) {
+          auto &file = files.find(name)->second;
+          file.content.append(data, data_length);
+          return true;
+        });
+    } else {
+      std::string body;
+      content_reader([&](const char *data, size_t data_length) {
+        body.append(data, data_length);
+        return true;
+      });
+      res.set_content(body, "text/plain");
+    }
+  });
+```
+
 ### Chunked transfer encoding
 
 ```cpp
@@ -119,7 +156,7 @@ svr.Get("/chunked", [&](const Request& req, Response& res) {
 });
 ```
 
-### Default thread pool supporet
+### Default thread pool support
 
 Set thread count to 8:
 
@@ -287,16 +324,23 @@ std::shared_ptr<httplib::Response> res =
 
 This feature was contributed by [underscorediscovery](https://github.com/yhirose/cpp-httplib/pull/23).
 
-### Basic Authentication
+### Authentication
+
+NOTE: OpenSSL is required for Digest Authentication, since cpp-httplib uses message digest functions in OpenSSL.
 
 ```cpp
 httplib::Client cli("httplib.org");
+cli.set_auth("user", "pass");
 
-auto res = cli.Get("/basic-auth/hello/world", {
-  httplib::make_basic_authentication_header("hello", "world")
-});
+// Basic
+auto res = cli.Get("/basic-auth/user/pass");
 // res->status should be 200
-// res->body should be "{\n  \"authenticated\": true, \n  \"user\": \"hello\"\n}\n".
+// res->body should be "{\n  \"authenticated\": true, \n  \"user\": \"user\"\n}\n".
+
+// Digest
+res = cli.Get("/digest-auth/auth/user/pass/SHA-256");
+// res->status should be 200
+// res->body should be "{\n  \"authenticated\": true, \n  \"user\": \"user\"\n}\n".
 ```
 
 ### Range

example/Makefile

@@ -33,4 +33,4 @@ pem:
 	openssl req -new -key key.pem | openssl x509 -days 3650 -req -signkey key.pem > cert.pem
 
 clean:
-	rm server client hello simplesvr upload redirect *.pem
+	rm server client hello simplesvr upload redirect benchmark *.pem

example/simplesvr.cc

@@ -46,10 +46,7 @@ string dump_multipart_files(const MultipartFiles &files) {
     snprintf(buf, sizeof(buf), "content type: %s\n", file.content_type.c_str());
     s += buf;
 
-    snprintf(buf, sizeof(buf), "text offset: %lu\n", file.offset);
-    s += buf;
-
-    snprintf(buf, sizeof(buf), "text length: %lu\n", file.length);
+    snprintf(buf, sizeof(buf), "text length: %lu\n", file.content.size());
     s += buf;
 
     s += "----------------\n";

example/upload.cc

@@ -37,10 +37,10 @@ int main(void) {
 
   svr.Post("/post", [](const Request & req, Response &res) {
     auto file = req.get_file_value("file");
-    cout << "file: " << file.offset << ":" << file.length << ":" << file.filename << endl;
+    cout << "file length: " << file.content.length() << ":" << file.filename << endl;
 
     ofstream ofs(file.filename, ios::binary);
-    ofs << req.body.substr(file.offset, file.length);
+    ofs << file.content;
 
     res.set_content("done", "text/plain");
   });

test/test.cc

@@ -30,6 +30,12 @@ const std::string JSON_DATA = "{\"hello\":\"world\"}";
 
 const string LARGE_DATA = string(1024 * 1024 * 100, '@'); // 100MB
 
+MultipartFile& get_file_value(MultipartFiles &files, const char *key) {
+  auto it = files.find(key);
+  if (it != files.end()) { return it->second; }
+  throw std::runtime_error("invalid mulitpart form data name error");
+}
+
 #ifdef _WIN32
 TEST(StartupTest, WSAStartup) {
   WSADATA wsaData;
@@ -463,8 +469,50 @@ TEST(BaseAuthTest, FromHTTPWatch) {
               "{\n  \"authenticated\": true, \n  \"user\": \"hello\"\n}\n");
     EXPECT_EQ(200, res->status);
   }
+
+  {
+    cli.set_auth("hello", "world");
+    auto res = cli.Get("/basic-auth/hello/world");
+    ASSERT_TRUE(res != nullptr);
+    EXPECT_EQ(res->body,
+              "{\n  \"authenticated\": true, \n  \"user\": \"hello\"\n}\n");
+    EXPECT_EQ(200, res->status);
+  }
 }
 
+#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
+TEST(DigestAuthTest, FromHTTPWatch) {
+  auto host = "httpbin.org";
+  auto port = 443;
+  httplib::SSLClient cli(host, port);
+
+  {
+    auto res = cli.Get("/digest-auth/auth/hello/world");
+    ASSERT_TRUE(res != nullptr);
+    EXPECT_EQ(401, res->status);
+  }
+
+  {
+    std::vector<std::string> paths = {
+      "/digest-auth/auth/hello/world/MD5",
+      "/digest-auth/auth/hello/world/SHA-256",
+      "/digest-auth/auth/hello/world/SHA-512",
+      "/digest-auth/auth-init/hello/world/MD5",
+      "/digest-auth/auth-int/hello/world/MD5",
+    };
+
+    cli.set_auth("hello", "world");
+    for (auto path: paths) {
+      auto res = cli.Get(path.c_str());
+      ASSERT_TRUE(res != nullptr);
+      EXPECT_EQ(res->body,
+                "{\n  \"authenticated\": true, \n  \"user\": \"hello\"\n}\n");
+      EXPECT_EQ(200, res->status);
+    }
+  }
+}
+#endif
+
 TEST(AbsoluteRedirectTest, Redirect) {
   auto host = "httpbin.org";
 
@@ -567,6 +615,7 @@ protected:
 
   virtual void SetUp() {
     svr_.set_base_dir("./www");
+    svr_.set_base_dir("./www2", "/mount");
 
     svr_.Get("/hi",
              [&](const Request & /*req*/, Response &res) {
@@ -675,29 +724,27 @@ protected:
                 {
                   const auto &file = req.get_file_value("text1");
                   EXPECT_EQ("", file.filename);
-                  EXPECT_EQ("text default",
-                            req.body.substr(file.offset, file.length));
+                  EXPECT_EQ("text default", file.content);
                 }
 
                 {
                   const auto &file = req.get_file_value("text2");
                   EXPECT_EQ("", file.filename);
-                  EXPECT_EQ("aωb", req.body.substr(file.offset, file.length));
+                  EXPECT_EQ("aωb", file.content);
                 }
 
                 {
                   const auto &file = req.get_file_value("file1");
                   EXPECT_EQ("hello.txt", file.filename);
                   EXPECT_EQ("text/plain", file.content_type);
-                  EXPECT_EQ("h\ne\n\nl\nl\no\n",
-                            req.body.substr(file.offset, file.length));
+                  EXPECT_EQ("h\ne\n\nl\nl\no\n", file.content);
                 }
 
                 {
                   const auto &file = req.get_file_value("file3");
                   EXPECT_EQ("", file.filename);
                   EXPECT_EQ("application/octet-stream", file.content_type);
-                  EXPECT_EQ(0u, file.length);
+                  EXPECT_EQ(0u, file.content.size());
                 }
               })
         .Post("/empty",
@@ -752,16 +799,57 @@ protected:
                 EXPECT_EQ("5", req.get_header_value("Content-Length"));
               })
         .Post("/content_receiver",
-              [&](const Request & /*req*/, Response &res,
-                  const ContentReader &content_reader) {
-                std::string body;
-                content_reader([&](const char *data, size_t data_length) {
-                  EXPECT_EQ(data_length, 7);
-                  body.append(data, data_length);
-                  return true;
-                });
-                EXPECT_EQ(body, "content");
-                res.set_content(body, "text/plain");
+              [&](const Request & req, Response &res, const ContentReader &content_reader) {
+                if (req.is_multipart_form_data()) {
+                  MultipartFiles files;
+                  content_reader(
+                    [&](const std::string &name, const MultipartFile &file) {
+                      files.emplace(name, file);
+                      return true;
+                    },
+                    [&](const std::string &name, const char *data, size_t data_length) {
+                      auto &file = files.find(name)->second;
+                      file.content.append(data, data_length);
+                      return true;
+                    });
+
+                  EXPECT_EQ(5u, files.size());
+
+                  {
+                    const auto &file = get_file_value(files, "text1");
+                    EXPECT_EQ("", file.filename);
+                    EXPECT_EQ("text default", file.content);
+                  }
+
+                  {
+                    const auto &file = get_file_value(files, "text2");
+                    EXPECT_EQ("", file.filename);
+                    EXPECT_EQ("aωb", file.content);
+                  }
+
+                  {
+                    const auto &file = get_file_value(files, "file1");
+                    EXPECT_EQ("hello.txt", file.filename);
+                    EXPECT_EQ("text/plain", file.content_type);
+                    EXPECT_EQ("h\ne\n\nl\nl\no\n", file.content);
+                  }
+
+                  {
+                    const auto &file = get_file_value(files, "file3");
+                    EXPECT_EQ("", file.filename);
+                    EXPECT_EQ("application/octet-stream", file.content_type);
+                    EXPECT_EQ(0u, file.content.size());
+                  }
+                } else {
+                  std::string body;
+                  content_reader([&](const char *data, size_t data_length) {
+                    EXPECT_EQ(data_length, 7);
+                    body.append(data, data_length);
+                    return true;
+                  });
+                  EXPECT_EQ(body, "content");
+                  res.set_content(body, "text/plain");
+                }
               })
         .Put("/content_receiver",
              [&](const Request & /*req*/, Response &res,
@@ -808,14 +896,13 @@ protected:
                 {
                   const auto &file = req.get_file_value("key1");
                   EXPECT_EQ("", file.filename);
-                  EXPECT_EQ("test", req.body.substr(file.offset, file.length));
+                  EXPECT_EQ("test", file.content);
                 }
 
                 {
                   const auto &file = req.get_file_value("key2");
                   EXPECT_EQ("", file.filename);
-                  EXPECT_EQ("--abcdefg123",
-                            req.body.substr(file.offset, file.length));
+                  EXPECT_EQ("--abcdefg123", file.content);
                 }
               })
 #endif
@@ -1003,9 +1090,42 @@ TEST_F(ServerTest, GetMethodOutOfBaseDir2) {
   EXPECT_EQ(404, res->status);
 }
 
-TEST_F(ServerTest, InvalidBaseDir) {
-  EXPECT_EQ(false, svr_.set_base_dir("invalid_dir"));
-  EXPECT_EQ(true, svr_.set_base_dir("."));
+TEST_F(ServerTest, GetMethodDirMountTest) {
+  auto res = cli_.Get("/mount/dir/test.html");
+  ASSERT_TRUE(res != nullptr);
+  EXPECT_EQ(200, res->status);
+  EXPECT_EQ("text/html", res->get_header_value("Content-Type"));
+  EXPECT_EQ("test.html", res->body);
+}
+
+TEST_F(ServerTest, GetMethodDirMountTestWithDoubleDots) {
+  auto res = cli_.Get("/mount/dir/../dir/test.html");
+  ASSERT_TRUE(res != nullptr);
+  EXPECT_EQ(200, res->status);
+  EXPECT_EQ("text/html", res->get_header_value("Content-Type"));
+  EXPECT_EQ("test.html", res->body);
+}
+
+TEST_F(ServerTest, GetMethodInvalidMountPath) {
+  auto res = cli_.Get("/mount/dir/../test.html");
+  ASSERT_TRUE(res != nullptr);
+  EXPECT_EQ(404, res->status);
+}
+
+TEST_F(ServerTest, GetMethodOutOfBaseDirMount) {
+  auto res = cli_.Get("/mount/../www2/dir/test.html");
+  ASSERT_TRUE(res != nullptr);
+  EXPECT_EQ(404, res->status);
+}
+
+TEST_F(ServerTest, GetMethodOutOfBaseDirMount2) {
+  auto res = cli_.Get("/mount/dir/../../www2/dir/test.html");
+  ASSERT_TRUE(res != nullptr);
+  EXPECT_EQ(404, res->status);
+}
+
+TEST_F(ServerTest, InvalidBaseDirMount) {
+  EXPECT_EQ(false, svr_.set_base_dir("./www3", "invalid_mount_point"));
 }
 
 TEST_F(ServerTest, EmptyRequest) {
@@ -1279,7 +1399,7 @@ TEST_F(ServerTest, GetStreamedWithRangeMultipart) {
 }
 
 TEST_F(ServerTest, GetStreamedEndless) {
-  size_t offset = 0;
+  uint64_t offset = 0;
   auto res = cli_.Get("/streamed-cancel",
                       [&](const char * /*data*/, uint64_t data_length) {
                         if (offset < 100) {
@@ -1484,6 +1604,21 @@ TEST_F(ServerTest, PostContentReceiver) {
   ASSERT_EQ("content", res->body);
 }
 
+TEST_F(ServerTest, PostMulitpartFilsContentReceiver) {
+  MultipartFormDataItems items = {
+      {"text1", "text default", "", ""},
+      {"text2", "aωb", "", ""},
+      {"file1", "h\ne\n\nl\nl\no\n", "hello.txt", "text/plain"},
+      {"file2", "{\n  \"world\", true\n}\n", "world.json", "application/json"},
+      {"file3", "", "", "application/octet-stream"},
+  };
+
+  auto res = cli_.Post("/content_receiver", items);
+
+  ASSERT_TRUE(res != nullptr);
+  EXPECT_EQ(200, res->status);
+}
+
 TEST_F(ServerTest, PostContentReceiverGzip) {
   auto res = cli_.Post("/content_receiver", "content", "text/plain", true);
   ASSERT_TRUE(res != nullptr);
@@ -1673,6 +1808,89 @@ TEST_F(ServerTest, MultipartFormDataGzip) {
 }
 #endif
 
+// Sends a raw request to a server listening at HOST:PORT.
+static bool send_request(time_t read_timeout_sec, const std::string& req) {
+  auto client_sock =
+      detail::create_client_socket(HOST, PORT, /*timeout_sec=*/5);
+
+  if (client_sock == INVALID_SOCKET) { return false; }
+
+  return detail::process_and_close_socket(
+      true, client_sock, 1, read_timeout_sec, 0,
+      [&](Stream& strm, bool /*last_connection*/,
+          bool &/*connection_close*/) -> bool {
+        if (req.size() !=
+            static_cast<size_t>(strm.write(req.data(), req.size()))) {
+          return false;
+        }
+
+        char buf[512];
+
+        detail::stream_line_reader line_reader(strm, buf, sizeof(buf));
+        while (line_reader.getline()) {}
+        return true;
+      });
+}
+
+TEST(ServerRequestParsingTest, TrimWhitespaceFromHeaderValues) {
+  Server svr;
+  std::string header_value;
+  svr.Get("/validate-ws-in-headers",
+          [&](const Request &req, Response &res) {
+            header_value = req.get_header_value("foo");
+            res.set_content("ok", "text/plain");
+          });
+
+  thread t = thread([&] { svr.listen(HOST, PORT); });
+  while (!svr.is_running()) {
+    msleep(1);
+  }
+
+  // Only space and horizontal tab are whitespace. Make sure other whitespace-
+  // like characters are not treated the same - use vertical tab and escape.
+  const std::string req =
+      "GET /validate-ws-in-headers HTTP/1.1\r\n"
+      "foo: \t \v bar \e\t \r\n"
+      "Connection: close\r\n"
+      "\r\n";
+
+  ASSERT_TRUE(send_request(5, req));
+  svr.stop();
+  t.join();
+  EXPECT_EQ(header_value, "\v bar \e");
+}
+
+TEST(ServerRequestParsingTest, ReadHeadersRegexComplexity) {
+  Server svr;
+  svr.Get("/hi",
+          [&](const Request & /*req*/, Response &res) {
+            res.set_content("ok", "text/plain");
+          });
+
+  // Server read timeout must be longer than the client read timeout for the
+  // bug to reproduce, probably to force the server to process a request
+  // without a trailing blank line.
+  const time_t client_read_timeout_sec = 1;
+  svr.set_read_timeout(client_read_timeout_sec + 1, 0);
+  bool listen_thread_ok = false;
+  thread t = thread([&] { listen_thread_ok = svr.listen(HOST, PORT); });
+  while (!svr.is_running()) {
+    msleep(1);
+  }
+
+  // A certain header line causes an exception if the header property is parsed
+  // naively with a single regex. This occurs with libc++ but not libstdc++.
+  const std::string req =
+      "GET /hi HTTP/1.1\r\n"
+      " :                                                                      "
+      "                                                                       ";
+
+  ASSERT_TRUE(send_request(client_read_timeout_sec, req));
+  svr.stop();
+  t.join();
+  EXPECT_TRUE(listen_thread_ok);
+}
+
 class ServerTestWithAI_PASSIVE : public ::testing::Test {
 protected:
   ServerTestWithAI_PASSIVE()

test/www2/dir/index.html

@@ -0,0 +1,8 @@
+<html>
+<head>
+</head>
+<body>
+  <a href="/dir/test.html">Test</a>
+  <a href="/hi">hi</a>
+</body>
+</html>

test/www2/dir/test.html

@@ -0,0 +1 @@
+test.html

test/www3/dir/index.html

@@ -0,0 +1,8 @@
+<html>
+<head>
+</head>
+<body>
+  <a href="/dir/test.html">Test</a>
+  <a href="/hi">hi</a>
+</body>
+</html>

test/www3/dir/test.html

@@ -0,0 +1 @@
+test.html