Personal challenge. Sensible or stupidity?

lonewolff · Post by **lonewolff** » Sat Sep 13, 2008 7:26 am

I am thinking of challenging myself by creating an entire website from a single C++ executable (to run server side) and possibly a MySQL database.

Has this been done before, do you guys know?

What do you think of this idea?

syedhs · Post by **syedhs** » Sat Sep 13, 2008 7:40 am

It is already been done many times before and the C++ application should adhere to CGI specification or if in Windows IIS, you can take advantage of NSAPI/ISAPI (not really sure either or both which are applicable). The keyword here is C++ app should be able to retrieve query and form string and then replied back by writing the output for an example.

I think the reason of doing it this way is because you wanna protect the source code especially if your customer can host your web app int their server. And there is this benefit from better performance.

Regarding protecting the source code, web script language can be obfuscated, so there is no real benefit in this area.

lonewolff · Post by **lonewolff** » Sat Sep 13, 2008 10:09 am

Bummer, I thought I was onto something relatively new

So, with these sites, the entry point is something like http://www.whatever.com/index.exe ?

triton · Post by **triton** » Sat Sep 13, 2008 10:38 am

http://en.wikipedia.org/wiki/FastCGI

KevinMulder · Post by **KevinMulder** » Sat Sep 13, 2008 6:26 pm

lonewolff wrote:Bummer, I thought I was onto something relatively new

So, with these sites, the entry point is something like http://www.whatever.com/index.exe ?

... and millions of firewalls and internet protections system will deny to connect to your site, because the above url is like what mostly used in spam/trojans emails ...

lonewolff · Post by **lonewolff** » Sun Sep 14, 2008 1:44 am

KevinMulder wrote:
lonewolff wrote:Bummer, I thought I was onto something relatively new

So, with these sites, the entry point is something like http://www.whatever.com/index.exe ?
... and millions of firewalls and internet protections system will deny to connect to your site, because the above url is like what mostly used in spam/trojans emails ...

How can that be? The executable is run server side (not client side) and generates the HTML itself. So, this will work on a non Win32 platform that doesn't even know what an exe file is. Like Linux, Mac, Solaris, etc...

Post by **CABAListic** » Sun Sep 14, 2008 2:27 am

lonewolff wrote: How can that be? The executable is run server side (not client side) and generates the HTML itself. So, this will work on a non Win32 platform that doesn't even know what an exe file is. Like Linux, Mac, Solaris, etc...

No, it's about the form of the URL ending in .exe. Usually URLs like that are download links, and some more paranoid firewalls would probably take exception to that (though I wouldn't find that particularly useful, seeing as how it would kill a lot of legal downloads, too).

Of course, the easy solution would be not to use that particular file extension. In fact, CGI applications are often called via mod_rewrite or similar mechanisms, anyway.

lonewolff · Post by **lonewolff** » Sun Sep 14, 2008 2:35 am

Hmmm. I'll have to do some testing.

In IIS, I initially had my exe folder set to 'script only' permissions and my brower was having a heart attack about it and was trying to download the exe. After setting IIS on my server to 'script & executables' my browser (on another machine) was now behaving as per what I wanted.

Anyone got a secure system (that they feel in pretty locked down) that wants to be a test bunny?

lonewolff · Post by **lonewolff** » Sun Sep 14, 2008 2:45 am

I have done a small test app at the following link;

Test website

All it does is call up a plain webpage (embedded in the exe) and uses parameter Ogre to display...

Hello Ogre

If you guys could give this a try for me to see if this works as intended or if it fails due to firewall / antivirus etc... That would be awesome.

I am guessing this should work fine for everyone as I cant see how a client system will see this as a security risk as nothing is actually being downloaded to the client machine (exe wise)

Zool · Post by **Zool** » Sun Sep 14, 2008 2:48 am

Wt, C++ Web Toolkit: http://www.webtoolkit.eu/wt

lonewolff · Post by **lonewolff** » Sun Sep 14, 2008 3:43 am

If anyone wants to give my test exe based site a go, the complete webiste source is as follows;

Code: Select all

#include <iostream>
#include <stdlib.h>
#include <stdio.h>

void main(int argc, char *args[], char *envp[])
{
	char name[128]="",input[4096];
	int length;
	std::cout<<"Content-type: text/html\n\n";

	sscanf(getenv("CONTENT_LENGTH"),"%d",&length);
	for(int i=0;i<length;i++)std::cin >>input[i];
	input[length]='\0';
	sscanf(input,"myname=%s",name);

	std::cout<<"<H1>Hello "<<name<<"</H1>\n";
}

Located here >> Test website

Let us know how it goes. I would love to test this firewall theory. I believe it will work fine.

lonewolff · Post by **lonewolff** » Sun Sep 14, 2008 9:00 am

Going by my IIS logs there have been a bunch of people who have tried the link.

I am interested were these successful?

Post by **betajaen** » Sun Sep 14, 2008 11:50 am

I love these sorts of challenges.

I remember doing this once, using .NET and winsock. However I couldn't test it on the internet with other people; I've always used Linux webservers.

lonewolff · Post by **lonewolff** » Sun Sep 14, 2008 12:10 pm

Cool!

I started thinking about this topic yesterday, as I just started writing an app to email me input from a form from a website. So, far it seems to be working well.

Also using Winsock for that too (with C++).

So, anyone out there having any failures with my link?(<<Here) I am tending to think it will work fine, as nothing is run client side. It is my server generating the webpage dynamically.

So far my logs tell me nine people have tried and no-one has posted to say it didn't work for them. Am I to assume that I am right?

Nauk · Post by **Nauk** » Sun Sep 14, 2008 3:23 pm

I tried and it works fine, I think it is a good way for absolute freedom and creativity because you have nearly no limits there and a nice performance.

The downside probably will show when your application takes on size and becomes more complex, having to hit compile every change is a total nuisance (like .NET based Web-Applications), but then again depends what you want to do with it, but it is certainly fun to toy around with it

and you can always add a a scripting language.

Curious to see where you will go with that.

warmi · Post by **warmi** » Sun Sep 14, 2008 6:52 pm

Nauk wrote:I tried and it works fine, I think it is a good way for absolute freedom and creativity because you have nearly no limits there and a nice performance.

The downside probably will show when your application takes on size and becomes more complex, having to hit compile every change is a total nuisance (like .NET based Web-Applications), but then again depends what you want to do with it, but it is certainly fun to toy around with it and you can always add a a scripting language.

Curious to see where you will go with that.

Generally, these apps tend to be I/O bound anyway which means the choice of language is not that important (within reasonable bounds of course)

lonewolff · Post by **lonewolff** » Sun Sep 14, 2008 10:15 pm

Nauk wrote:I tried and it works fine, I think it is a good way for absolute freedom and creativity because you have nearly no limits there and a nice performance.

The downside probably will show when your application takes on size and becomes more complex, having to hit compile every change is a total nuisance (like .NET based Web-Applications), but then again depends what you want to do with it, but it is certainly fun to toy around with it and you can always add a a scripting language.

Curious to see where you will go with that.

Thanks Nauk. I'll keep you informed.

Thrakbad · Post by **Thrakbad** » Mon Sep 15, 2008 2:52 pm

lonewolff wrote:Going by my IIS logs there have been a bunch of people who have tried the link.

I am interested were these successful?

Works fine for me at work. But our firewall is not really restrictive.

Minthos · Post by **Minthos** » Mon Sep 15, 2008 3:56 pm

You could always change the address to something other than .exe - .cgi for example.

Worked for me too btw, but I don't have any stupid filtering here (at home).

lonewolff · Post by **lonewolff** » Sat Sep 20, 2008 12:44 am

Funnily enough. I have had quite a few people access my test exe site from a variety of platforms and no-one has reported a failure. I think it is safe to assume that this is a legit way of doing things.

Nauk · Post by **Nauk** » Sat Sep 20, 2008 1:08 am

As long as you are returning proper HTTP headers in ASCII form you should be fine, no matter what script / binary you call on the server.

paddy · Post by **paddy** » Sat Sep 20, 2008 11:42 pm

The one performance issue is the fact the exe application instance is created, then terminated with each call, where it is more efficient to have the request be passed to a continuously running service - if I remember correctly.

The C++ code will run very efficiently should it have to do heavy lifting, so the trade off can quickly end up in your favor for any level of work, but for light weight requests it probably drags more.

Of course, if I recall correctly, most CGI based systems (at least on windows servers) work this way, launching the PERL interpreter for each request - but my information could be out of date.

I played with it about 8 years ago or so, but then switched to interpreted languages. Also, I still find URLs with .dll extensions - not sure what the differences are but that could be an avenue as well.