Page 1 of 1
Personal challenge. Sensible or stupidity?
Posted: Sat Sep 13, 2008 7:26 am
by lonewolff
I am thinking of challenging myself by creating an entire website from a single C++ executable (to run server side) and possibly a MySQL database.
Has this been done before, do you guys know?
What do you think of this idea?
Posted: Sat Sep 13, 2008 7:40 am
by syedhs
It is already been done many times before and the C++ application should adhere to CGI specification or if in Windows IIS, you can take advantage of NSAPI/ISAPI (not really sure either or both which are applicable). The keyword here is C++ app should be able to retrieve query and form string and then replied back by writing the output for an example.
I think the reason of doing it this way is because you wanna protect the source code especially if your customer can host your web app int their server. And there is this benefit from better performance.
Regarding protecting the source code, web script language can be obfuscated, so there is no real benefit in this area.
Posted: Sat Sep 13, 2008 10:09 am
by lonewolff
Bummer, I thought I was onto something relatively new
So, with these sites, the entry point is something like
http://www.whatever.com/index.exe ?
Posted: Sat Sep 13, 2008 10:38 am
by triton
Posted: Sat Sep 13, 2008 6:26 pm
by KevinMulder
... and millions of firewalls and internet protections system will deny to connect to your site, because the above url is like what mostly used in spam/trojans emails ...
Posted: Sun Sep 14, 2008 1:44 am
by lonewolff
KevinMulder wrote:
... and millions of firewalls and internet protections system will deny to connect to your site, because the above url is like what mostly used in spam/trojans emails ...
How can that be? The executable is run server side (not client side) and generates the HTML itself. So, this will work on a non Win32 platform that doesn't even know what an exe file is. Like Linux, Mac, Solaris, etc...
Posted: Sun Sep 14, 2008 2:27 am
by CABAListic
lonewolff wrote:
How can that be? The executable is run server side (not client side) and generates the HTML itself. So, this will work on a non Win32 platform that doesn't even know what an exe file is. Like Linux, Mac, Solaris, etc...
No, it's about the form of the URL ending in .exe. Usually URLs like that are download links, and some more paranoid firewalls would probably take exception to that (though I wouldn't find that particularly useful, seeing as how it would kill a lot of legal downloads, too).
Of course, the easy solution would be not to use that particular file extension. In fact, CGI applications are often called via mod_rewrite or similar mechanisms, anyway.
Posted: Sun Sep 14, 2008 2:35 am
by lonewolff
Hmmm. I'll have to do some testing.
In IIS, I initially had my exe folder set to 'script only' permissions and my brower was having a heart attack about it and was trying to download the exe. After setting IIS on my server to 'script & executables' my browser (on another machine) was now behaving as per what I wanted.
Anyone got a secure system (that they feel in pretty locked down) that wants to be a test bunny?
Posted: Sun Sep 14, 2008 2:45 am
by lonewolff
I have done a small test app at the following link;
Test website
All it does is call up a plain webpage (embedded in the exe) and uses parameter Ogre to display...
Hello Ogre
If you guys could give this a try for me to see if this works as intended or if it fails due to firewall / antivirus etc... That would be awesome.
I am guessing this should work fine for everyone as I cant see how a client system will see this as a security risk as nothing is actually being downloaded to the client machine (exe wise)
Posted: Sun Sep 14, 2008 2:48 am
by Zool
Posted: Sun Sep 14, 2008 3:43 am
by lonewolff
If anyone wants to give my test exe based site a go, the complete webiste source is as follows;
Code: Select all
#include <iostream>
#include <stdlib.h>
#include <stdio.h>
void main(int argc, char *args[], char *envp[])
{
char name[128]="",input[4096];
int length;
std::cout<<"Content-type: text/html\n\n";
sscanf(getenv("CONTENT_LENGTH"),"%d",&length);
for(int i=0;i<length;i++)std::cin >>input[i];
input[length]='\0';
sscanf(input,"myname=%s",name);
std::cout<<"<H1>Hello "<<name<<"</H1>\n";
}
Located here >>
Test website
Let us know how it goes. I would love to test this firewall theory. I believe it will work fine.
Posted: Sun Sep 14, 2008 9:00 am
by lonewolff
Going by my IIS logs there have been a bunch of people who have tried the link.
I am interested were these successful?
Posted: Sun Sep 14, 2008 11:50 am
by betajaen
I love these sorts of challenges.
I remember doing this once, using .NET and winsock. However I couldn't test it on the internet with other people; I've always used Linux webservers.
Posted: Sun Sep 14, 2008 12:10 pm
by lonewolff
Cool!
I started thinking about this topic yesterday, as I just started writing an app to email me input from a form from a website. So, far it seems to be working well.
Also using Winsock for that too (with C++).
So, anyone out there having any failures with my
link?(<<Here) I am tending to think it will work fine, as nothing is run client side. It is my server generating the webpage dynamically.
So far my logs tell me nine people have tried and no-one has posted to say it didn't work for them. Am I to assume that I am right?
Posted: Sun Sep 14, 2008 3:23 pm
by Nauk
I tried and it works fine, I think it is a good way for absolute freedom and creativity because you have nearly no limits there and a nice performance.
The downside probably will show when your application takes on size and becomes more complex, having to hit compile every change is a total nuisance (like .NET based Web-Applications), but then again depends what you want to do with it, but it is certainly fun to toy around with it
and you can always add a a scripting language.
Curious to see where you will go with that.
Posted: Sun Sep 14, 2008 6:52 pm
by warmi
Nauk wrote:I tried and it works fine, I think it is a good way for absolute freedom and creativity because you have nearly no limits there and a nice performance.
The downside probably will show when your application takes on size and becomes more complex, having to hit compile every change is a total nuisance (like .NET based Web-Applications), but then again depends what you want to do with it, but it is certainly fun to toy around with it
and you can always add a a scripting language.
Curious to see where you will go with that.
Generally, these apps tend to be I/O bound anyway which means the choice of language is not that important (within reasonable bounds of course)
Posted: Sun Sep 14, 2008 10:15 pm
by lonewolff
Nauk wrote:I tried and it works fine, I think it is a good way for absolute freedom and creativity because you have nearly no limits there and a nice performance.
The downside probably will show when your application takes on size and becomes more complex, having to hit compile every change is a total nuisance (like .NET based Web-Applications), but then again depends what you want to do with it, but it is certainly fun to toy around with it
and you can always add a a scripting language.
Curious to see where you will go with that.
Thanks Nauk. I'll keep you informed.
Posted: Mon Sep 15, 2008 2:52 pm
by Thrakbad
lonewolff wrote:Going by my IIS logs there have been a bunch of people who have tried the link.
I am interested were these successful?
Works fine for me at work. But our firewall is not really restrictive.
Posted: Mon Sep 15, 2008 3:56 pm
by Minthos
You could always change the address to something other than .exe - .cgi for example.
Worked for me too btw, but I don't have any stupid filtering here (at home).
Posted: Sat Sep 20, 2008 12:44 am
by lonewolff
Funnily enough. I have had quite a few people access my test exe site from a variety of platforms and no-one has reported a failure. I think it is safe to assume that this is a legit way of doing things.
Posted: Sat Sep 20, 2008 1:08 am
by Nauk
As long as you are returning proper HTTP headers in ASCII form you should be fine, no matter what script / binary you call on the server.
Posted: Sat Sep 20, 2008 11:42 pm
by paddy
The one performance issue is the fact the exe application instance is created, then terminated with each call, where it is more efficient to have the request be passed to a continuously running service - if I remember correctly.
The C++ code will run very efficiently should it have to do heavy lifting, so the trade off can quickly end up in your favor for any level of work, but for light weight requests it probably drags more.
Of course, if I recall correctly, most CGI based systems (at least on windows servers) work this way, launching the PERL interpreter for each request - but my information could be out of date.
I played with it about 8 years ago or so, but then switched to interpreted languages. Also, I still find URLs with .dll extensions - not sure what the differences are but that could be an avenue as well.