Apache HTTP Server explained

Apache HTTP Server
Author:Robert McCool
Developer:Apache Software Foundation
Released:[1]
Operating System:Unix-like, Microsoft Windows,[2] OpenVMS
Programming Language:C[3]
Genre:Web server
License:Apache-2.0

The Apache HTTP Server is a free and open-source cross-platform web server software, released under the terms of Apache License 2.0. It is developed and maintained by a community of developers under the auspices of the Apache Software Foundation.

The vast majority of Apache HTTP Server instances run on a Linux distribution,[4] but current versions also run on Microsoft Windows,[5] OpenVMS,[6] and a wide variety of Unix-like systems. Past versions also ran on NetWare, OS/2 and other operating systems, including ports to mainframes.[7]

Originally based on the NCSA HTTPd server, development of Apache began in early 1995 after work on the NCSA code stalled.[8] Apache played a key role in the initial growth of the World Wide Web,[9] quickly overtaking NCSA HTTPd as the dominant HTTP server. In 2009, it became the first web server software to serve more than 100 million websites.[10]

, Netcraft estimated that Apache served 23.04% of the million busiest websites, while Nginx served 22.01%; Cloudflare at 19.53% and Microsoft Internet Information Services at 5.78% rounded out the top four. For some of Netcraft's other stats, Nginx is ahead of Apache.[11] According to W3Techs' review of all web sites, in June 2022 Apache was ranked second at 31.4% and Nginx first at 33.6%, with Cloudflare Server third at 21.6%.[12]

Name

According to The Apache Software Foundation, its name was chosen "from respect for the various Native American nations collectively referred to as Apache, well-known for their superior skills in warfare strategy and their inexhaustible endurance".[13] This was in a context in which it seemed that the open internet -- based on free exchange of open source code -- appeared to be soon subjected to a kind of conquer by proprietary software vendor Microsoft; Apache co-creator Brian Behlendorf -- originator of the name -- saw his effort somewhat parallel that of Geronimo, Chief of the last of the free Apache peoples.[14] [15] But it conceded that the name "also makes a cute pun on 'a patchy web server'—a server made from a series of patches".

There are other sources for the "patchy" software pun theory, including the project's official documentation in 1995, which stated: "Apache is a cute name which stuck. It was based on some existing code and a series of software patches, a pun on 'A PAtCHy' server."[16] [17]

But in an April 2000 interview, Behlendorf asserted that the origins of Apache were not a pun, stating:[18]

In January 2023, the US-based non-profit Natives in Tech accused the Apache Software Foundation of cultural appropriation and urged them to change the foundation's name, and consequently also the names of the software projects it hosts.[19] [20]

When Apache is running under Unix, its process name is, which is short for "HTTP daemon".[21]

Feature overview

Apache supports a variety of features, many implemented as compiled modules which extend the core functionality. These can range from authentication schemes to supporting server-side programming languages such as Perl, Python, Tcl and PHP. Popular authentication modules include mod_access, mod_auth, mod_digest, and mod_auth_digest, the successor to mod_digest. A sample of other features include Secure Sockets Layer and Transport Layer Security support (mod_ssl), a proxy module (mod_proxy), a URL rewriting module (mod_rewrite), custom log files (mod_log_config), and filtering support (mod_include and mod_ext_filter).

Popular compression methods on Apache include the external extension module, mod_gzip, implemented to help with reduction of the size (weight) of web pages served over HTTP. ModSecurity is an open source intrusion detection and prevention engine for Web applications. Apache logs can be analyzed through a Web browser using free scripts, such as AWStats/W3Perl or Visitors.

Virtual hosting allows one Apache installation to serve many different websites. For example, one computer with one Apache installation could simultaneously serve example.com, example.org, test47.test-server.example.edu, etc.

Apache features configurable error messages, DBMS-based authentication databases, content negotiation and supports several graphical user interfaces (GUIs).

It supports password authentication and digital certificate authentication. Because the source code is freely available, anyone can adapt the server for specific needs, and there is a large public library of Apache add-ons.[22]

A more detailed list of features is provided below:

Performance

Instead of implementing a single architecture, Apache provides a variety of MultiProcessing Modules (MPMs), which allow it to run in either a process-based mode, a hybrid (process and thread) mode, or an event-hybrid mode, in order to better match the demands of each particular infrastructure. Choice of MPM and configuration is therefore important. Where compromises in performance must be made, Apache is designed to reduce latency and increase throughput relative to simply handling more requests, thus ensuring consistent and reliable processing of requests within reasonable time-frames.

For delivering static pages, Apache 2.2 series was considered significantly slower than nginx and varnish.[39] To address this issue, the Apache developers created the Event MPM, which mixes the use of several processes and several threads per process in an asynchronous event-based loop.[40] This architecture as implemented in the Apache 2.4 series performs at least as well as event-based web servers, according to Jim Jagielski and other independent sources.[41] [42] [43] However, some independent but significantly outdated benchmarks show that it is still half as fast as nginx, e.g.[44]

Licensing

The Apache HTTP Server codebase was relicensed to the Apache 2.0 License (from the previous 1.1 license) in January 2004,[45] and Apache HTTP Server 1.3.31 and 2.0.49 were the first releases using the new license.[46]

The OpenBSD project did not like the change and continued the use of pre-2.0 Apache versions, effectively forking Apache 1.3.x for its purposes.[47] [48] [49] They initially replaced it with Nginx, and soon after made their own replacement, OpenBSD Httpd, based on the Relayd project.[50] [51] [52] [53]

Versions

Version 1.1:The Apache License 1.1 was approved by the ASF in 2000: The primary change from the 1.0 license is in the 'advertising clause' (section 3 of the 1.0 license); derived products are no longer required to include attribution in their advertising materials, only in their documentation.

Version 2.0:The ASF adopted the Apache License 2.0 in January 2004. The stated goals of the license included making the license easier for non-ASF projects to use, improving compatibility with GPL-based software, allowing the license to be included by reference instead of listed in every file, clarifying the license on contributions, and requiring a patent license on contributions that necessarily infringe a contributor's own patents.

Development

Versions of Apache HTTP Server
VersionInitial releaseLatest release
1998-06-06[54] 2010-02-03 (1.3.42)[55]
2002-04-06[56] 2013-07-10 (2.0.65)[57]
2005-12-01[58] 2017-07-11 (2.2.34)[59]
2012-02-21[60] 2024-07-17 (2.4.62)[61]
The Apache HTTP Server Project is a collaborative software development effort aimed at creating a robust, commercial-grade, feature-rich and freely available source code implementation of an HTTP (Web) server. The project is jointly managed by a group of volunteers located around the world, using the Internet and the Web to communicate, plan, and develop the server and its related documentation. This project is part of the Apache Software Foundation. In addition, hundreds of users have contributed ideas, code, and documentation to the project.[62] [63] [64]

Apache 2.4 dropped support for BeOS, TPF, A/UX, NeXT, and Tandem platforms.[65]

Security

Apache, like other server software, can be hacked and exploited. The main Apache attack tool is Slowloris, which exploits a bug in Apache software.[66] It creates many sockets and keeps each of them alive and busy by sending several bytes (known as "keep-alive headers") to let the server know that the computer is still connected and not experiencing network problems. The Apache developers have addressed Slowloris with several modules to limit the damage caused; the Apache modules mod_limitipconn, mod_qos, mod_evasive, mod security, mod_noloris, and mod_antiloris have all been suggested as means of reducing the likelihood of a successful Slowloris attack.[67] [68] Since Apache 2.2.15, Apache ships the module mod_reqtimeout as the official solution supported by the developers.[69]

See also

Notes and References

  1. Web site: About the Apache HTTP Server Project. Apache Software Foundation. 2008-06-25. https://web.archive.org/web/20080607122013/http://httpd.apache.org/ABOUT_APACHE.html. 7 June 2008 . live.
  2. Web site: Compiling and Installing. httpd.apache.org. The Apache Software Foundation. 9 May 2016. 7 May 2016. https://web.archive.org/web/20160507054137/http://httpd.apache.org/docs/2.4/install.html. live.
  3. Web site: Apache Software Foundation Index: Projects by Programming Language Index . 2016-02-27 . dead . https://web.archive.org/web/20160302011644/http://projects-old.apache.org/indexes/language.html . 2016-03-02 .
  4. Web site: OS/Linux Distributions using Apache. secure1.securityspace.com. 2018-09-17. 2018-09-18. https://web.archive.org/web/20180918054337/https://secure1.securityspace.com/s_survey/data/man.201808/apacheos.html. live.
  5. Web site: Platform Specific Notes - Apache HTTP Server Version 2.4. httpd.apache.org. 2019-01-21. 2019-01-22. https://web.archive.org/web/20190122044008/https://httpd.apache.org/docs/2.4/platform/index.html.en. live.
  6. Web site: Secure Web Server. 2020-10-20. vmssoftware.com. 2020-10-22. https://web.archive.org/web/20201022051216/https://vmssoftware.com/products/secure-web-server/. live.
  7. Web site: The Apache EBCDIC Port - Apache HTTP Server Version 2.4. httpd.apache.org. 2019-08-16. 2019-02-27. https://web.archive.org/web/20190227063613/http://httpd.apache.org/docs/2.4/platform/ebcdic.html.en. live.
  8. Web site: About the Apache HTTP Server Project - The Apache HTTP Server Project . 2024-02-08 . httpd.apache.org.
  9. http://news.netcraft.com/archives/web_server_survey.html Netcraft Market Share
  10. Web site: February 2009 Web Server Survey. 18 February 2009 . Netcraft. 2009-03-29. https://web.archive.org/web/20090226092501/http://news.netcraft.com//archives//2009//02//18//february_2009_web_server_survey.html. 26 February 2009 . live.
  11. Web site: March 2022 Web Server Survey . 2022-06-18 . Netcraft News . 29 March 2022 . en-gb . 2022-05-28 . https://web.archive.org/web/20220528125224/https://news.netcraft.com/archives/2022/03/29/march-2022-web-server-survey.html . live .
  12. Web site: Usage Statistics of Web Servers . w3techs.com . 2022-06-18 . 2023-07-25 . https://web.archive.org/web/20230725191205/https://w3techs.com/technologies/overview/web_server . live .
  13. Web site: Apache Foundation . www.apache.org . 22 August 2018 . 13 December 2021 . https://web.archive.org/web/20211213004914/https://www.apache.org/foundation/faq.html#name . live .
  14. Web site: "Trillions and Trillions Served" documentary feature on The Apache Software Foundation . https://ghostarchive.org/varchive/youtube/20211122/JUt2nb0mgwg. 2021-11-22 . live. TheApacheFoundation / Youtube . 2020 .
  15. Web site: A Foundation of Trust: Building a Blockchain Future : Brian Behlendorf . https://ghostarchive.org/varchive/youtube/20211122/u_dhmGNeNEc. 2021-11-22 . live. 2020-02-10 . Long Now Foundation / YouTube .
  16. Web site: Information on the Apache HTTP Server Project . 1997-04-15 . dead . https://web.archive.org/web/19970415054031/http://www.apache.org/info.html . April 15, 1997 .
  17. Web site: Apache Server Frequently Asked Questions. 15 January 2017. https://web.archive.org/web/19970106233141/http://www.apache.org/docs/misc/FAQ.html#relate . 1997-01-06.
  18. Web site: Apache Power. Linux Magazine . Robert. McMillan. 15 April 2000. usurped. https://web.archive.org/web/20190128065900/http://www.linux-mag.com/id/472/ . 28 January 2019.
  19. Web site: Claburn . Thomas . 2023-01-11 . Native Americans ask Apache foundation to change name . live . https://web.archive.org/web/20230112000842/https://www.theregister.com/2023/01/11/native_american_apache_software_foundation/ . 2023-01-12 . 2023-01-12 . . en.
  20. Web site: Purdy . Kevin . 2023-01-12 . Indigenous tech group asks Apache Foundation to change its name . 2023-01-12 . Ars Technica . en-us . 2023-01-12 . https://web.archive.org/web/20230112181127/https://arstechnica.com/gadgets/2023/01/indigenous-tech-group-asks-apache-foundation-to-change-its-name/ . live .
  21. Web site: Apache Docs . httpd.apache.org . 22 August 2018 . 5 September 2018 . https://web.archive.org/web/20180905182937/http://httpd.apache.org/docs/current/invoking.html . live .
  22. Web site: Apache Web Server. webopedia.com. 23 March 1998. 12 May 2021. 12 May 2021. https://web.archive.org/web/20210512193103/https://www.webopedia.com/definitions/apache-web-server/. live.
  23. Web site: Apache HTTP Server Tutorial: .htaccess files . Apache.org . 2016-02-19 . 2016-02-25 . https://web.archive.org/web/20160225155611/http://httpd.apache.org/docs/2.4/howto/htaccess.html . live .
  24. Web site: mod_proxy . Apache.org . 2016-02-19 . 2018-07-29 . https://web.archive.org/web/20180729204047/http://httpd.apache.org/docs/2.4/mod/mod_proxy.html . live .
  25. Web site: mod_proxy_balancer . Apache.org . 2016-02-19 . 2016-02-13 . https://web.archive.org/web/20160213163641/http://httpd.apache.org/docs/2.4/mod/mod_proxy_balancer.html . live .
  26. Web site: Balancer Manager. Apache.org. 2016-02-19. 2016-03-04. https://web.archive.org/web/20160304103556/https://httpd.apache.org/docs/trunk/howto/reverse_proxy.html#manager. live.
  27. Web site: Authentication and Authorization. Apache.org. 2016-02-19. 2018-01-31. https://web.archive.org/web/20180131130634/http://httpd.apache.org/docs/2.4/howto/auth.html. live.
  28. Web site: mod_rewrite . Apache.org . 2016-02-19 . 2016-02-13 . https://web.archive.org/web/20160213152803/http://httpd.apache.org/docs/2.4/mod/mod_rewrite.html . live .
  29. Web site: mod_headers . Apache.org . 2016-02-19 . 2016-02-21 . https://web.archive.org/web/20160221033800/http://httpd.apache.org/docs/2.4/mod/mod_headers.html . live .
  30. Web site: mod_sed . Apache.org . 2016-02-19 . 2016-03-04 . https://web.archive.org/web/20160304013210/https://httpd.apache.org/docs/2.4/mod/mod_sed.html . live .
  31. Web site: mod_substitute . Apache.org . 2016-02-19 . 2016-03-04 . https://web.archive.org/web/20160304073406/http://httpd.apache.org/docs/2.4/mod/mod_substitute.html . live .
  32. Web site: Apache httpd Tutorial: Introduction to Server Side Includes . Apache.org . 2016-02-19 . 2016-02-18 . https://web.archive.org/web/20160218133535/http://httpd.apache.org/docs/2.4/howto/ssi.html . live .
  33. Web site: mod_usertrack . Apache.org . 2021-05-12 . 2021-05-12 . https://web.archive.org/web/20210512192558/http://httpd.apache.org/docs/2.4/mod/mod_usertrack.html . live .
  34. Web site: Apache Tutorial: Dynamic Content with CGI . Apache.org . 2016-02-19 . 2021-11-15 . https://web.archive.org/web/20211115181448/https://httpd.apache.org/docs/2.4/howto/cgi.html . live .
  35. Web site: Per-user web directories . Apache.org . 2016-02-19 . 2016-02-16 . https://web.archive.org/web/20160216122731/http://httpd.apache.org/docs/2.4/howto/public_html.html . live .
  36. Web site: Expressions in Apache HTTP Server. Apache.org. 2016-02-19. 2016-02-29. https://web.archive.org/web/20160229120307/http://httpd.apache.org/docs/2.4/expr.html. live.
  37. Web site: mod_status . Apache.org . 2016-02-19 . 2016-02-13 . https://web.archive.org/web/20160213154107/http://httpd.apache.org/docs/2.4/mod/mod_status.html . live .
  38. Web site: Apache Module: mod_ftp . Apache.org . 2017-07-08 . 2017-07-10 . https://web.archive.org/web/20170710072314/http://httpd.apache.org/mod_ftp/mod/mod_ftp.html . live .
  39. Web site: Serving static files: a comparison between Apache, Nginx, Varnish and G-WAN. Spoot!. 14 March 2011. 23 April 2014. 24 April 2014. https://web.archive.org/web/20140424234153/http://nbonvin.wordpress.com/2011/03/14/apache-vs-nginx-vs-varnish-vs-gwan/. live.
  40. Web site: worker - Apache HTTP Server Version 2.2. apache.org. 2021-05-12. 2021-05-10. https://web.archive.org/web/20210510050745/https://httpd.apache.org/docs/2.2/mod/worker.html. live.
  41. Web site: Apache httpd 2.4. 2012-02-08. 2012-01-27. https://web.archive.org/web/20120127033804/http://people.apache.org/~jim/presos/ACNA11/Apache_httpd_cloud.pdf. live.
  42. Web site: Picking a Proxy Server. 14 April 2014. 19 February 2016. 3 March 2016. https://web.archive.org/web/20160303105755/http://www.slideshare.net/bryan_call/choosing-a-proxy-server-apachecon-2014. live.
  43. Web site: Throughput evaluation of Apache 2.4.1. 22 February 2012 . 2016-02-19. 2016-03-02. https://web.archive.org/web/20160302133533/http://blog.matsumoto-r.jp/?p=1812. live.
  44. Web site: Performance of Apache 2.4 with the event MPM compared to Nginx. eschrade.com. 3 January 2014. 13 March 2014. 13 March 2014. https://web.archive.org/web/20140313213901/http://www.eschrade.com/page/performance-of-apache-2-4-with-the-event-mpm-compared-to-nginx/. live.
  45. Web site: Apache License, Version 2.0. The Apache Software Foundation. January 2004. 2013-05-21. 2013-05-18. https://web.archive.org/web/20130518072534/http://www.apache.org/licenses/LICENSE-2.0.html. live.
  46. FYI: Apache HTTP Server 2.0.49 Released. Burton. Richard Antony. alt.apache.configuration. 2018-02-16.
  47. The new apache license. de Raadt. Theo. Theo de Raadt. openbsd-misc. 18 February 2004. 2013-05-21.
  48. Web site: Copyright Policy. OpenBSD. 2013-05-12. 2017-11-13. https://web.archive.org/web/20171113040622/http://www.openbsd.org/policy.html. live.
  49. Web site: apache-httpd-openbsd-1.3.20140502p2 – OpenBSD improved and secured version of Apache 1.3 . OpenBSD ports . 2014-12-28 . 2015-03-02 . https://web.archive.org/web/20150302031504/http://ports.su/www/apache-httpd-openbsd . live .
  50. News: Marvin . Rob . Inside OpenBSD's new httpd Web server . 12 October 2019 . SD Times . 25 March 2015 . 12 October 2019 . https://web.archive.org/web/20191012215958/https://sdtimes.com/httpd/inside-openbsds-new-httpd-web-server/ . live .
  51. Web site: OpenBSD Upgrade Guide: 5.1 to 5.2. openbsd.org. 2014-03-13. 2017-12-22. https://web.archive.org/web/20171222055544/http://www.openbsd.org/faq/upgrade52.html#nginx. live.
  52. Web site: Heads Up: Apache Removed from Base. 2014-03-14. OpenBSD Journal. jj. 2014-12-29. 2014-10-18. https://web.archive.org/web/20141018182803/http://www.undeadly.org/cgi?action=article&sid=20140314080734. live.
  53. Web site: OpenBSD Upgrade Guide: 5.5 to 5.6. openbsd.org. 2014-12-29. 2014-12-22. https://web.archive.org/web/20141222025858/http://www.openbsd.org/faq/upgrade56.html#ToPorts. live.
  54. Web site: Announcement: Apache 1.3.0 Released !. 1998-06-06. 2015-01-06. 2018-12-11. https://web.archive.org/web/20181211203756/https://marc.info/?l=apache-httpd-announce&m=90221040625561&w=2. live.
  55. Web site: Apache HTTP Server 1.3.42 released (final release of 1.3.x). apache.org. 2015-01-06. 2015-03-11. https://web.archive.org/web/20150311184801/http://mail-archives.apache.org/mod_mbox/httpd-announce/201002.mbox/%3C20100203000334.GA19021@infiltrator.stdlib.net%3E. live.
  56. Web site: Official Release: Apache 2.0.35 is now GA. 2002-04-06. 2015-01-06. 2018-12-12. https://web.archive.org/web/20181212084822/https://marc.info/?l=apache-httpd-announce&m=101810732100356&w=2. live.
  57. Web site: [Announcement] Apache HTTP Server 2.0.65 Released]. apache.org. 2015-01-06. 2015-07-28. https://web.archive.org/web/20150728000646/http://mail-archives.apache.org/mod_mbox/httpd-announce/201307.mbox/%3C20130710124920.2b8793ed.wrowe@rowe-clan.net%3E. live.
  58. Web site: Apache HTTP Server 2.2.0 Released. 2005-12-01. 2015-01-06. 2018-12-12. https://web.archive.org/web/20181212145848/https://marc.info/?l=apache-httpd-announce&m=113347470201565&w=2. live.
  59. Web site: [Announce] Apache HTTP Server 2.2.34 Released]. apache.org. 2019-04-03. 2020-08-21. https://web.archive.org/web/20200821113300/https://mail-archives.apache.org/mod_mbox/www-announce/201707.mbox/%3CCACsi2512a0dKZm5SEb9GyNH6nMfs1+swpxyui3c+UZUwvi3vvg@mail.gmail.com%3E. live.
  60. Web site: [ANNOUNCEMENT] Apache HTTP Server 2.4.1 Released]. 2012-02-21. 2015-07-17. 2021-02-12. https://web.archive.org/web/20210212205004/https://marc.info/?l=apache-httpd-announce&m=132983471818384&w=2. live.
  61. Web site: Apache HTTP Server 2.4.62 Released . 2017-10-25 . apache.org.
  62. Web site: About the Apache HTTP Server Project - The Apache HTTP Server Project. Documentation Group. apache.org. 2021-05-12. 2008-06-07. https://web.archive.org/web/20080607122013/http://httpd.apache.org/ABOUT_APACHE.html. live.
  63. Web site: The Apache HTTP Server Open Source Project on Ohloh. (n.d.). Ohloh, the open source network. Retrieved November 12, 2012. February 8, 2012. March 9, 2012. https://web.archive.org/web/20120309003935/https://www.ohloh.net/p/apache. live.
  64. Web site: Chapter 4. The Apache HTTP Server. fedoraproject.org. 2012-12-03. 2012-11-25. https://web.archive.org/web/20121125111059/http://docs.fedoraproject.org/en-US/Fedora/13/html/Managing_Confined_Services/chap-Managing_Confined_Services-The_Apache_HTTP_Server.html. dead.
  65. Web site: Upgrading to 2.4 from 2.2 . Platform support has been removed for BeOS, TPF, and even older platforms such as A/UX, Next, and Tandem. These were believed to be broken anyway. . 2021-05-12 . 2021-05-10 . https://web.archive.org/web/20210510141206/https://httpd.apache.org/docs/2.4/upgrading.html . live .
  66. Web site: Apache HTTP DoS tool mitigation. Zdrnja. Bojan. SANS Institute. 21 June 2009. 12 November 2021. 12 November 2021. https://web.archive.org/web/20211112130802/https://isc.sans.edu/diary/Apache+HTTP+DoS+tool+mitigation/6613. live.
  67. Web site: Slowloris HTTP DoS . 2009-06-26 . bot: unknown . https://web.archive.org/web/20150426090206/http://ha.ckers.org/slowloris . 26 April 2015 . dmy-all .
  68. Web site: mod_noloris: defending against DoS . July 2009 . niq's soapbox . 7 January 2012 . 8 October 2011 . https://web.archive.org/web/20111008151654/http://bahumbug.wordpress.com/2009/07/01/mod_noloris-defending-against-dos/ . live .
  69. Web site: mod_reqtimeout . Apache.org . 2013-07-03 . 2013-07-03 . https://web.archive.org/web/20130703041319/http://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html . live .

This article is licensed under the GNU Free Documentation License. It uses material from the Wikipedia article "Apache HTTP Server".

Except where otherwise indicated, Everything.Explained.Today is © Copyright 2009-2024, A B Cryer, All Rights Reserved. Cookie policy.