PHP Built-In Web Server

https://www.php.net/manual/en/features.commandline.webserver.php

by ZnZirconium • 6 years ago

141 85 6 years ago

incanus77• 6 years ago

I was heavily into PHP in the late 90s and early 00s, including hosting download mirrors, then left it for years for other tech in non-server areas. I got back to it recently to start playing with Micropub implementations and other indieweb stuff and was pleasantly surprised to find this server in there. It’d been a long while since MAMP and configuring Apache for me so it was nice to just not have to worry about unearthing that stuff again and hit the ground running on the actual software.

Aeolun• 6 years ago

To some extend. It running single threaded and doing only one request at a time is a bit painful.

rawfan• 6 years ago

It's not single threaded. There is `PHP_CLI_SERVER_WORKERS`.

wnevets2• 6 years ago

this is pretty old, why is it on the frontpage now?

kristopolous• 6 years ago

Apparently it's news to many

guessmyname• 6 years ago

Because ZnZirconium only learned about this today → https://xkcd.com/1053/

ericol• 6 years ago

"I was today years old when I found about it"

robjan• 6 years ago

In a previous post about PHP, people were complaining that you still require nginx or Apache. I guess OP found this while looking for an alternative.

dylan6042• 6 years ago

because the are people that run MAMP/WAMP in a production environment?

wnevets2• 6 years ago

but this is for dev only

It is not intended to be a full-featured web server. It should not be used on a public network.

ux-app• 6 years ago

I'm curious, what's wrong with this?

major505• 6 years ago

/well this will help when running it from a docker container.

lillesvin• 6 years ago

Absolutely, but you should probably only do it for development. As they write on the linked PHP manual page:

This web server was designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network.

paledot2• 6 years ago

That was my thought too (the sarcasm). This was amazing when it was introduced, but in the age of Docker it's no longer really relevant to bootstrapping a basic dev environment.

hrktb2• 6 years ago

It is still nice for quickly running something and get rid of it. For instance an ad-hoc script mocking an API endpoint that you can run on an arbitrary port in seconds.

PS: a few years ago docker was not deemed production ready, and people only used it as dev/testing environment. I find it funny that the reverse is sometimes happening, where people prefer running this webserver locally for speed and eventual debugging, while production runs on containers.

RandoHolmes• 6 years ago

Because apparently the only relevant people are those who have taken on the complexity of running docker?

I'm literally blown away by this comment.

aasasd• 6 years ago

runs only one single-threaded process

I'm pretty sure that PHP-FPM is a better choice.

mtmail• 6 years ago

Ad hoc (one line) HTTP static servers in various programming languages https://gist.github.com/willurd/5720255

1f60c• 6 years ago

It would be interesting if someone benchmarked them

ComputerGuru2• 6 years ago

They’re for dev purposes only; I think that would be testing for the wrong metric.

alwillis• 6 years ago

Thanks; I was looking for just this a couple of days ago.

userbinator• 6 years ago

Good to see a netcat one show up there --- it is capable of serving only a single file, and you need to prepend the response headers yourself, but it's been very useful the few times I've had to use it.

tdeck• 6 years ago

I"be seen netcat used to support oauth login in some shell scripts.

IgorPartola3• 6 years ago

Missed a couple:

  $ apache2
  $ nginx

My point is that while lots of languages include a web server in their standard library (one of these was a damn install! Like yes you can pip/gem/npm/etc install a server, that doesn’t make it a one line web server), it is by no means a one liner any more than the above two examples can be considered bash one liners.

the_pwner224• 6 years ago

On practically any linux (or mac) you can do $ python -m http.server 8080 to instantly start up a server in that directory. You can do this in multiple terminals to have multiple servers on different ports serving multiple directories. Nginx, Apache require significant configuration and reboot to apply changes. They're not at all comparable.

ComputerGuru2• 6 years ago

No, these don’t have configuration files and can be set up from the command line arguments.

tardismechanic• 6 years ago

Warning This web server was designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network.

throwaway8941• 6 years ago

It's also pretty slow. I use it in development sometimes, and it easily blocks on a single long request.

Works fine for development though, or if you want a quick and dirty solution to send a large file to a smartphone (or whatever).

halfdan• 6 years ago

Looks like that as of 7.4 it supports multiple workers for concurrent request handling.

phre4k• 6 years ago

Want to bet some people will integrate this into their "prod" Docker containers?

ClikeX• 6 years ago

I smell a Medium article coming up.

deepstack• 6 years ago

Yup. With the way how php has being deploying over the last 20 years I wouldn't be surprised.

frenchman99• 6 years ago

This web server has been available for a long time. Sure you can misuse pretty much any technology. Rolling your own crypto is possible too but most people don't do it.

People tend to use ready-made Docker containers for PHP deployment. The official PHP image has apache and fpm versions: https://hub.docker.com/_/php/

johnchristopher• 6 years ago

I bet people won't. Ready-made docker solutions are based around nginx/apache and shared hosting stacks were in place long before php built-in webserver was available. There's no reasons and incentives to change all that.

deweller• 6 years ago

It is also single threaded. One would see serious performance issues if one tried to use this in production with any significant traffic.

fomine3• 6 years ago

I love PHP's buildin web server than other languages for quick use because its command line is quite easy to remember.

php -S localhost:8080

Aachen• 6 years ago

On Linux, php -S 0:8080 is shorter if you're just testing (as it's meant for) and have a firewall - though it opens it for 0.0.0.0 (anyone who can reach your system).

Not sure about other OSes, I think I noticed this doesn't work on Windows once but that could also have been BSD or something.

aussieguy12345• 6 years ago

While not built into node, I like "serve" best in terms of syntax, even if it only supports static sites.

serve . Done

adrianpike• 6 years ago

Oh man, this sucker. I did some filthy stuff in a legacy PHP codebase using this to get some ultra basic acceptance and smoke tests in place. It worked fairly well, but there were a lot of weird edge casees where it didn't _quite_ work like a real webserver. I've got some notes hiding on an old laptop, I should dust those off and post them up sometime.

yegle• 6 years ago

This sounds like a perfect solution to self-hosting websites (e.g. wiki, grocy, monica) that's protected by an identity-aware proxy (e.g. Pomerium) that are expected to receive <1qps traffic.

(Most of my self-hosted web services are written in Go, I've being able to stay nginx-free thanks to Go's built-in web server.)

sleavey2• 6 years ago

I use this to host a small WordPress blog on my server whenever I want to make changes that I then compile into static HTML for public access. Works well enough and avoids the need to lock down a public WordPress instance.

indigodaddy• 6 years ago

So you just fire it up whenever you need to login and write a post, and then shut it down or?

ssl232• 6 years ago

Yeah, exactly. I edit or write posts once every few weeks or months so this works for me.

wila2• 6 years ago

What are you using to generate the static html?

adambxyz• 6 years ago

I've used a plugin called WP2Static to turn WP sites into static HTML. You can also use WGET to crawl the site and export HTML, but it requires some tinkering. Google "export Wordpress to HTML using WGET" to find some walkthroughs.

superasn• 6 years ago

This is really cool for making local apps which have a web-ui instead of gtk/electron based ui.

I've been using this in a lot of small tools(1) where I use this server to load the web-ui in the browser and a PHP script for file IO.

(1) https://github.com/san-kumar/kanban

(2) https://github.com/san-kumar/devtodo2-web-extension

zaarn• 6 years ago

I wouldn't rely on the PHP WS, it's a bit of a buggy crapshot and loves to crash when encountering complicated errors.

mstade2• 6 years ago

I've been doing this with singe file html pages that bundle all dependencies inline, no server necessary. It does put some restrictions on what you can do, since local files are sandboxed pretty hard, but with all dependencies inlined (and with WebAssembly you can get pretty crazy, like embedding SQLite in an html file) you can do quite a lot.

Just the other week I made a little app that loads CSV files from a room booking system to create monthly reports, which was done manually by the sole employee of our housing association and took several hours – now it takes minutes.

It's been my go to way to create easily deployed rich GUI apps for the past year or so, and is pretty simple to build with a few shell scripts to put it all together. The resulting html files can be big, but they load really quite fast and since they're deployed on to a machine and not served over a network the size doesn't matter that much. It's also way less than an electron deployment anyway.

erikw• 6 years ago

What is the tooling and workflow you use for this? It's not something that had occurred to me, but now that you mention it, it seems like something I'd like to try.

Edit: It looks like none of the major bundlers support this feature out of the box, but there is a project called in inliner that does exactly this: https://github.com/remy/inliner

guanzo• 6 years ago

The node examples can be true one liners if you use npx

onion2k2• 6 years ago

I have an absolute hatred of putting unused code on a production server, especially if it's something that can listen to network traffic. It's such an unnecessary risk. The fact that you don't appear to be able to set PHP up in a way that disables the use of this thing feels horrible. There's no way I'd ever want to run PHP outside of a container that I have control over which few ports are mapped to now.

7demons• 6 years ago

Time to take some medication maybe? Such hatred against programming language is not normal.

onion2k2• 6 years ago

I don't hate the programming language. PHP is a great language that I used for a decade before moving over to the frontend. I don't use it any more but I work in a company that does and I see good results when it's deployed. This is not about PHP (or Python, or Ruby, as they also have built-in httpd servers).

What I hate is the idea of putting something on a server that's going to make my life harder, or create more work for my team. I don't want the developers I work with having to give up their evenings or weekends to resolve issues and incidents that arose from things shouldn't have existed in the first place. That's why I don't want additional network services sneaking their way on to production. I should very easily be able to tell which applications on a server are listening to external traffic.

Maintaining good security is hard enough without language runtimes including things that should strictly only ever be a development dependency rather than a production dependency.

If there are pills I can take to make this problem go away, sign me up.

zuppy• 6 years ago

honestly, I would never run anything important in production that's not behind a load balancer+firewall, so without direct internet access. it helps with upgrades, as you can upgrade separately each node without putting down the application and it provides security because you only whitelist what you want to give external access (yes, I know there are still other attacking vectors, but still, security is an incremental job that adds on layers and layers of best practices)

Sysosmaster2• 6 years ago

This is only present in the CLI builds of php, And you should limit who can run the php scripts anyway on a production server.

Remember that setting up a reverse shell only requires a networkable shell (like bash). Most linuxes (including containers) there for have the capability of having reverse shells started on them. The way to protect abuse of PHP’s webserver function is the same as the one to protect against bash reverse shells. Do not allow any outbound traffic but only traffic you trust!

Do not blame php for having a feature that others have had for years. PHP’s version is no better or worse than any of them.

aussieguy12345• 6 years ago

The PHP built in web server is useful in development. It's not intended for production. Good for getting a quick example running locally

jrururufuf666• 6 years ago

php is great and this is not news. all the haters go to your hipster frameworks and spend the time i need to build an app with just setting up your boilerplates.

aussieguy12345• 6 years ago

I'm considering adding something like this to https://expose.sh to serve static sites (like React apps) publicly in one command.

Something like:

expose serve public

Your site is ready at https://a3rd.expose.sh

Then your static side would be served from localhost over a public URL which you could then use for demos (or helping your backend guy do the integration). This wouldn't be too difficult to implement.

pixelatedindex• 6 years ago

Are there any major differences between expose and ngrok? Why would I choose one over the other?

milankragujevic• 6 years ago

Expose is much cheaper.

aussieguy12345• 6 years ago

Expose focuses on http and https whereas ngrok supports all kinds of protocols like SSH etc.

This makes the syntax a bit simpler instead of "ngrok http 80" it's "expose 80".

If I added this "expose serve" feature that would be one thing it could do that ngrok can't as yet

stunt• 6 years ago

"You can configure the built-in webserver to fork multiple workers in order to test code that requires multiple concurrent requests to the built-in webserver."

The built-in web-server itself was released with PHP 5.4 (2012). The only thing new about it is support for multiple workers to make it faster for concurrent request handling. But, it's still only intended for development environment and testing. I imagine multiple-workers support is very useful with SPA development, and especially improves testing speed if you run concurrent tests that rely on built-in web-server.

romanovcode• 6 years ago

I don't get it. This is since 5.4 which is like 6 years ago.

ourcat• 6 years ago

I wonder if the 'news' is the 7.4.0 change that allows for configuration for multiple concurrent requests, by spinning-up numbers of workers as needed?

tinus_hn• 6 years ago

As this apparently has been around for a while, hows the security of this server?

PHP Built-In Web Server

Related Stories