Kcgi – minimal CGI and FastCGI library for C/C++

Kcgi is a compact, open-source C/C++ library for building CGI and FastCGI web applications that prioritises minimalism, auditability and security. It provides a small API (khttp_parse, khttp_head, khttp_body, khttp_puts, khttp_free and related kjson/khtml/kxml helpers) for parsing requests and emitting responses, plus helpers for JSON/XML output, cookies, multipart and form handling, validation, authentication, compression and configurable output caching. Example programs and a broad set of manpages and tutorials (getting started, cookies, FastCGI deployment, custom validation, C++ usage, CORS and pledge(2) best practices) document common tasks; the current release is 1.0.1 with a macOS shared-library naming fix.

The core design isolates parsing and validation of untrusted HTTP input inside a sandboxed child process, returning sanitized data to the parent over a socket to reduce attack surface. Sandboxing adapts to each OS using seccomp on Linux, pledge on OpenBSD, sandbox_init on macOS and Capsicum on FreeBSD, supplemented by resource limits; this requires avoiding environment access inside sandboxed validators. Deployment targets include Apache, nginx and httpd with FastCGI (kfcgi) and chrooted setups (static linking recommended), and builds on many Unix-like platforms with BSD make and zlib as primary deps. A regression test framework (make regress and kcgiregress) supports automated testing.