Apache HTTP Server Version 2.3

Apache > HTTP Server > Documentation > Version 2.3

# Overview of new features in Apache HTTP Server 2.4

Available Languages: en | fr

This document describes some of the major changes between the 2.2 and 2.4 versions of the Apache HTTP Server. For new features since version 2.0, see the 2.2 new features document.

## Core Enhancements

KeepAliveTimeout in milliseconds
  It is now possible to specify `KeepAliveTimeout` in milliseconds.
Loadable MPMs
  Multiple MPMs can now be built as loadable modules at compile time. The MPM of choice can be configured at run time.
Per-module and per-directory LogLevel configuration
  The `LogLevel` can now be configured per module and per directory. New levels `trace1` to `trace8` have been added above the `debug` log level.
Event MPM
  The Event MPM is no longer experimental but is rather fully supported.
Asynchronous support
  Better support for asynchronous read/write for supporting MPMs and platforms.
Per-request configuration sections
  <`If`> sections can be used to set the configuration based on per-request criteria

## New Modules

`mod_allowmethods`
  New module to restrict certain HTTP methods without interfering with authentication or authorization.
`mod_buffer`
  Provides for buffering the input and output filter stacks
`mod_lua`
  Embeds the Lua language into httpd, for configuration and small business logic functions.
`mod_proxy_fcgi`
  FastCGI Protocol backend for `mod_proxy`
`mod_proxy_scgi`
  SCGI Protocol backend for `mod_proxy`
`mod_ratelimit`
  Provides Bandwidth Rate Limiting for Clients
`mod_reflector`
  Provides Reflection of a request body as a response via the output filter stack.
`mod_remoteip`
  Replaces the apparent client remote IP address and hostname for the request with the IP address list presented by a proxies or a load balancer via the request headers.
`mod_reqtimeout`
  Set timeout and minimum data rate for receiving requests
`mod_request`
  Provides Filters to handle and make available HTTP request bodies
`mod_slotmem_shm`
  Provides a Slot-based shared memory provider (ala the scoreboard).

## Module Enhancements

`mod_ssl`
  `mod_ssl` can now be configured to use an OCSP server to check the validation status of a client certificate. The default responder is configurable, along with the decision on whether to prefer the responder designated in the client certificate itself.
  `mod_ssl` now also supports OCSP stapling, where the server pro-actively obtains an OCSP verification of its certificate and transmits that to the client during the handshake.
  `mod_ssl` can now be configured to share SSL Session data between servers through memcached
`mod_proxy`
  The `ProxyPass` directive is now most optimally configured within a `Location` or `LocationMatch` block, and offers a significant performance advantage over the traditional two-parameter syntax when present in large numbers.
`mod_proxy_balancer`
  More runtime configuration changes for BalancerMembers via balancer-manager
  Additional BalancerMembers can be added at runtime via balancer-manager
  Runtime configuration of a subset of Balancer parameters
`mod_cache`
  `mod_cache` can now cache HEAD requests.
  Where possible, `mod_cache` directives can now be set per directory, instead of per server.
  The base URL of cached URLs can be customised, so that a cluster of caches can share the same endpoint URL prefix.
  `mod_cache` is now capable of serving stale cached data when a backend is unavailable (error 5xx).
  `mod_cache` can now insert HIT/MISS/REVALIDATE into an X-Cache header.
`mod_include`
  Support for the 'onerror' attribute within an 'include' element, allowing an error document to be served on error instead of the default error string.
`mod_cgi`, `mod_include`, `mod_isapi`, ...
  Translation of headers to environment variables is more strict than before to mitigate some possible cross-site-scripting attacks via header injection. Headers containing invalid characters (including underscores) are now silently dropped. Environment Variables in Apache has some pointers on how to work around broken legacy clients which require such headers. (This affects all modules which use these environment variables.)
`mod_authz_core` Authorization Logic Containers
  Advanced authorization logic may now be specified using the `Require` directive and the related container directives, such as `<RequireAll>`.
`mod_info`
  `mod_info` can now dump the pre-parsed configuration to stdout during server startup.
`mod_rewrite`
  `mod_rewrite` adds the `[QSD]` (Query String Discard) and `[END]` flags for `RewriteRule` to simplify common rewriting scenarios.

## Program Enhancements

fcgistarter
  FastCGI deamon starter utility
htcacheclean
  Current cached URLs can now be listed, with optional metadata included.
  Allow explicit deletion of individual cached URLs from the cache.
  File sizes can now be rounded up to the given block size, making the size limits map more closely to the real size on disk.
  Cache size can now be limited by the number of inodes, instead of or in addition to being limited by the size of the files on disk.

## Module Developer Changes

Check Configuration Hook Added
  A new hook, `check_config`, has been added which runs between the `pre_config` and `open_logs` hooks. It also runs before the `test_config` hook when the `-t` option is passed to `httpd`. The `check_config` hook allows modules to review interdependent configuration directive values and adjust them while messages can still be logged to the console. The user can thus be alerted to misconfiguration problems before the core `open_logs` hook function redirects console output to the error log.
Expression Parser Added
  We now have a general-purpose expression parser, whose API is exposed in ap_expr.h. This is adapted from the expression parser previously implemented in `mod_include`.
Authorization Logic Containers
  Authorization modules now register as a provider, via ap_register_auth_provider(), to support advanced authorization logic, such as `<RequireAll>`.
Small-Object Caching Interface
  The ap_socache.h header exposes a provider-based interface for caching small data objects, based on the previous implementation of the `mod_ssl` session cache. Providers using a shared-memory cyclic buffer, disk-based dbm files, and a memcache distributed cache are currently supported.
Cache Status Hook Added
  The `mod_cache` module now includes a new `cache_status` hook, which is called when the caching decision becomes known. A default implementation is provided which adds an optional `X-Cache` and `X-Cache-Detail` header to the response.

The developer documentation contains a detailed list of API changes.

Available Languages: en | fr