Question

I’m developing a rather complex application with both win32 and web access. Server side implementation is custom, and it’s going to be hosted in our company. The HTTP server could be implemented as a stand alone Indy (or another) HTTP server or more traditionally with Apache/IIS.

I’d like to know what are the advantages/disadvantages of stand alone HTTP server vs Apache/IIS, in terms of security or anything else you consider relevant.

Answer 1

I would say it depends on your needs and expectations. It is a big difference if you are writing a custom plain http server with maybe even ISAPI support etc…, or you are writing highly specialized http server / proxy / etc… that does only narrow specialized tasks. For instance I have such specialized proxy and a specialized ISAPI module handling framework. There are not so few advantages I would say. So pros are:

1. Ease of deployment. Try to deploy apache with your application to each and every machine
2. Better performance, smaller memory footprint. Try to use apache on low end laptops
3. Better security. Because you do only narrow tasks, chances of breach are a lot smaller. Apache does it all so chances of breach are a lot higher.
4. Complete control over the workings of such server and control over code. If you need slightly different behavior or new features, you got it.
5. If you are running ISAPI modules as I do, you can sandbox them in separate processes and achieve better stability. If one module / request crashes, the others are not hurt.

The cons:

1. Writing yet another http server
2. Learning the protocols and inner workings from zero
3. Way higher number of bugs and higher chances of errors because code is not yet battle hardened. This needs time to settle in.
4. Because you have narrow focus, you are not so versatile as Apache for comparison. Not necessarily bad as stated earlier.

My verdict would be like this. If you just need a plain http server for serving some content and you will host that in house, on one or few servers, go for Apache. If you are making a specialized http handling piece of code, that will be installed a lot and you need control, then develop your own. Trust me it is worth the time. I am so glad now, that I stuck to this back then, when we were deciding the very same thing. Now I have a lot of laptop installations of the software which is quite complex and I cannot imagine having to install Apache on each and every laptop. And then configuring it to work as I need it to.

And Indy (with all its troubles and quirks) has proven to be a very stable out of the box web server. ICS is the same here probably, but I haven’t used it yet for this so I cannot say. Setting up Indy HTTP server is ridiculously easy.

Just my two cents 😉