http_server.h

Go to the documentation of this file.

#ifndef SENSESP_NET_HTTP_SERVER_H_
#define SENSESP_NET_HTTP_SERVER_H_
 
#include "sensesp.h"
 
#include <ESPmDNS.h>
#include <IPAddress.h>
#include <esp_http_server.h>
#include <functional>
#include <list>
#include <memory>
 
#include "sensesp/net/http_authenticator.h"
#include "sensesp/system/serializable.h"
#include "sensesp_base_app.h"
 
// HTTP server worker task stack. Measured worst case on an ESP32-C3 was ~3.4 KB
// used by a config PUT (max-nesting JSON deserialize + SPIFFS save, with a long
// request URI on the same frame). The digest-auth path (a 1024-byte
// Authorization buffer + MD5/String temporaries) runs and returns before the
// handler, so it never stacks on top of it. 6144 leaves ~2.7 KB of headroom
// over the deepest measured path.
#ifndef HTTP_SERVER_STACK_SIZE
#define HTTP_SERVER_STACK_SIZE 6144
#endif
 
namespace sensesp {
 
#ifndef HTTP_DEFAULT_PORT
#define HTTP_DEFAULT_PORT 80
#endif
 
// Maximum simultaneous client sockets the HTTP server will accept.
//
// Kept at the esp_http_server default (7, of which 3 are reserved internally).
// The web UI stalls modern browsers suffered with this default were caused by
// keep-alive socket starvation, not the cap itself, and are addressed by
// enabling `lru_purge_enable` (see the HTTPServer constructor) rather than by
// claiming more of the lwIP socket budget — which the Signal K WebSocket
// client, mDNS, and SNTP also draw from.
//
// Raising this requires `CONFIG_LWIP_MAX_SOCKETS >= HTTP_SERVER_MAX_OPEN_SOCKETS
// + 3`; the espidf framework defaults that to 10, so values above 7 also need
// `CONFIG_LWIP_MAX_SOCKETS` raised in sdkconfig.defaults or httpd_start() fails.
#ifndef HTTP_SERVER_MAX_OPEN_SOCKETS
#define HTTP_SERVER_MAX_OPEN_SOCKETS 7
#endif
 
#include <ctype.h>
#include <stdlib.h>
 
void urldecode2(char* dst, const char* src);
String get_content_type(httpd_req_t* req);
esp_err_t call_request_dispatcher(httpd_req_t* req);
 
class HTTPServer;
 
class HTTPRequestHandler {
 public:
  HTTPRequestHandler(uint32_t method_mask, String match_uri,
                     std::function<esp_err_t(httpd_req_t*)> handler_func)
      : method_mask_(method_mask),
        match_uri_(match_uri),
        handler_func_(handler_func) {}
 
  const uint32_t method_mask_;
  const String match_uri_;
 
  esp_err_t call(httpd_req_t* req) { return this->handler_func_(req); }
 
 protected:
  const std::function<esp_err_t(httpd_req_t*)> handler_func_;
};
 
class HTTPServer : public FileSystemSaveable {
 public:
  HTTPServer(int port = HTTP_DEFAULT_PORT,
             const String& config_path = "/system/httpserver")
      : FileSystemSaveable(config_path), config_(HTTPD_DEFAULT_CONFIG()) {
    config_.server_port = port;
    config_.stack_size = HTTP_SERVER_STACK_SIZE;
    config_.max_uri_handlers = 20;
    config_.max_open_sockets = HTTP_SERVER_MAX_OPEN_SOCKETS;
    // The embedded SPA is served over HTTP/1.1 keep-alive, so a browser holds
    // several connections open. Without LRU purge, once every socket slot is
    // camped by an idle keep-alive connection the server defers (starves) any
    // new connection — a late chunk, a retried fetch, a second tab — until one
    // times out. On high-latency links (e.g. esp_hosted SDIO WiFi) that window
    // is long enough to fail the SPA's parallel /api/* requests outright.
    // Enabling LRU purge evicts the least-recently-used (idle) socket to admit
    // the newcomer instead, which the browser simply reopens.
    config_.lru_purge_enable = true;
    config_.uri_match_fn = httpd_uri_match_wildcard;
    String auth_realm_ = "Login required for " + SensESPBaseApp::get_hostname();
    load();
    if (auth_required_) {
      authenticator_ = std::unique_ptr<HTTPDigestAuthenticator>(
          new HTTPDigestAuthenticator(
              HTTPDigestAuthenticator::PrecomputedHA1{},
              username_, ha1_, auth_realm_));
    }
    event_loop()->onDelay(0, [this]() {
      esp_err_t error = httpd_start(&server_, &config_);
      if (error != ESP_OK) {
        ESP_LOGE(__FILENAME__, "Error starting HTTP server: %s",
                 esp_err_to_name(error));
        // Registering handlers or announcing mDNS against a failed handle would
        // leave the device advertising a dead web UI with no further signal.
        return;
      }
      ESP_LOGI(__FILENAME__, "HTTP server started");
 
      // register the request dispatcher for all methods and all URIs
      httpd_uri_t uri = {
          .uri = "/*",
          .method = HTTP_GET,
          .handler = call_request_dispatcher,
          .user_ctx = this,
      };
      httpd_register_uri_handler(server_, &uri);
      uri.method = HTTP_HEAD;
      httpd_register_uri_handler(server_, &uri);
      uri.method = HTTP_POST;
      httpd_register_uri_handler(server_, &uri);
      uri.method = HTTP_PUT;
      httpd_register_uri_handler(server_, &uri);
      uri.method = HTTP_DELETE;
      httpd_register_uri_handler(server_, &uri);
 
      // announce the server over mDNS
      MDNS.addService("http", "tcp", 80);
    });
  };
 
  void stop() { httpd_stop(server_); }
 
  void set_auth_credentials(const String& username, const String& password,
                            bool auth_required = true) {
    username_ = username;
    String realm = "Login required for " + SensESPBaseApp::get_hostname();
    ha1_ = MD5(username + ":" + realm + ":" + password);
    auth_required_ = auth_required;
  }
 
  void set_captive_portal(bool captive_portal,
                          IPAddress ap_ip = IPAddress()) {
    captive_portal_ = captive_portal;
    captive_portal_ap_ip_ = ap_ip;
  }
 
  virtual bool to_json(JsonObject& config) override {
    config["auth_required"] = auth_required_;
    config["username"] = username_;
    config["ha1"] = ha1_;
 
    return true;
  }
 
  virtual bool from_json(const JsonObject& config) override {
    if (config["auth_required"].is<bool>()) {
      auth_required_ = config["auth_required"];
    }
    if (config["username"].is<String>()) {
      username_ = config["username"].as<String>();
    }
    if (config["ha1"].is<String>()) {
      ha1_ = config["ha1"].as<String>();
    } else if (config["password"].is<String>()) {
      // Migrate from old plaintext password format
      String password = config["password"].as<String>();
      String realm = "Login required for " + SensESPBaseApp::get_hostname();
      ha1_ = MD5(username_ + ":" + realm + ":" + password);
      save();
    }
    return true;
  }
 
  void add_handler(std::shared_ptr<HTTPRequestHandler>& handler) {
    handlers_.push_back(handler);
  }
 
 protected:
  bool captive_portal_ = false;
  IPAddress captive_portal_ap_ip_;
  httpd_handle_t server_ = nullptr;
  httpd_config_t config_;
  String username_;
  String ha1_;  
  bool auth_required_ = false;
  std::unique_ptr<HTTPAuthenticator> authenticator_;
 
  bool authenticate_request(HTTPAuthenticator* auth,
                            std::function<esp_err_t(httpd_req_t*)> handler,
                            httpd_req_t* req);
 
  esp_err_t dispatch_request(httpd_req_t* req);
 
  bool handle_captive_portal(httpd_req_t* req);
 
  std::list<std::shared_ptr<HTTPRequestHandler>> handlers_;
 
  friend esp_err_t call_request_dispatcher(httpd_req_t* req);
};
 
inline const String ConfigSchema(const HTTPServer& obj) {
  return "null";
}
 
inline bool ConfigRequiresRestart(const HTTPServer& obj) { return true; }
 
}  // namespace sensesp
 
#endif  // SENSESP_NET_HTTP_SERVER_H_