Common Gateway Interface

Common Gateway Interface
National Center for Supercomputing Applications · Public domain · source
Name	Common Gateway Interface
Introduced	1993
Developer	Netscape Communications Corporation; NCSA
Written in	C (programming language)
Operating system	Unix; Microsoft Windows; OS/2; FreeBSD
License	RFC 3875 (informational)

Common Gateway Interface Common Gateway Interface is a standard protocol for interfacing external applications with web servers, enabling dynamic content generation for World Wide Web pages. It defined how HTTP servers invoke executable programs and scripts written in languages such as C (programming language), Perl, Python (programming language), and PHP to produce dynamic responses. Widely adopted by projects and organizations during the early development of the World Wide Web, it influenced subsequent specifications and server-side frameworks.

History

CGI emerged in the early 1990s amid developments at NCSA and CERN that shaped the World Wide Web. Early adopters included Netscape Communications Corporation and the Apache HTTP Server Project, which integrated CGI support as the web shifted from static documents to interactive services. Influential figures and groups such as Tim Berners-Lee, Rob McCool, and contributors to RFC 3875 formalized conventions used by implementers like Microsoft and Sun Microsystems in commercial web server products. The CGI model was central during the rise of content management efforts at institutions like MIT and publications hosted by The New York Times, and it informed later server extension mechanisms used by IIS, lighttpd, and nginx.

Design and Operation

The interface specifies how a web server invokes an external program: environment variables convey request metadata (method, query string, path info), while standard input and standard output transport payloads. Implementations used conventions compatible with POSIX systems and Microsoft Windows process semantics; many early CGI scripts were developed for Unix variants and FreeBSD. CGI programs interacted with logging systems used by Apache HTTP Server Project and event models resembling those in Netscape Communications Corporation servers. Common deployment scenarios integrated CGI with backend services such as MySQL, PostgreSQL, and Oracle Database, and connected to authentication systems like LDAP provided by vendors including Sun Microsystems and Microsoft.

Security Considerations

Because CGI programs run with server privileges, vulnerabilities impacted major organizations and infrastructure entities including National Security Agency, Department of Defense (United States), and large commercial sites like Amazon (company) and eBay. Common attack vectors mirrored vulnerabilities in projects such as Sendmail and BIND (software), including buffer overflows, injection attacks, and improper input validation. Mitigations drew on secure coding practices promoted by standards bodies like IETF and CERT Coordination Center; operational controls used by NASA and European Space Agency emphasized privilege separation and chroot jails. Security incidents involving CGI influenced adoption of sandboxing techniques from Google and Mozilla Foundation and hardened deployment recommendations from Microsoft and Oracle Corporation.

Implementations and Language Bindings

Implementations spanned servers and languages maintained by organizations including Apache Software Foundation, Microsoft, Sun Microsystems, IBM, NGINX, Inc., and Lighttpd. Language bindings and wrappers appeared for Perl, Python (programming language), Ruby (programming language), PHP, C#, Java (programming language), Lua (programming language), and R (programming language). Influential open-source projects such as CPAN, PyPI, RubyGems, PECL, and Maven (software) hosted modules easing CGI development. Enterprise stacks tied CGI front ends to middleware like Tomcat, JBoss, IIS, and WebSphere Application Server.

Performance and Alternatives

CGI’s process-per-request model led to scalability limits in high-traffic environments such as those experienced by Yahoo!, Google, Facebook, and Twitter. Alternatives emerged: server modules (e.g., mod_perl, mod_python), persistent interpreters in FastCGI, and interfaces like WSGI and Servlet specifications developed in contexts including Python Software Foundation and the Java Community Process. Event-driven servers from NGINX, Inc. and Node.js reduced overhead compared to CGI forks, while application platforms like Ruby on Rails and Django adopted persistent application models. Benchmarking and performance tuning were discussed in venues such as USENIX, ACM SIGCOMM, and IEEE conferences.

Deployment and Configuration

Administrators configured CGI support in servers provided by vendors including Apache Software Foundation, Microsoft, NGINX, Inc., and Lighttpd via directives, handler mappings, and execution permissions. Deployment best practices referenced work by IETF and configuration guidance from Red Hat and Debian maintainers; hosting control panels from cPanel and Plesk automated CGI enabling for shared hosts. Logging, monitoring, and orchestration integrated with tools like Nagios, Prometheus, Systemd, and Docker images maintained by GitHub repositories. Migration paths for legacy CGI applications often involved using compatibility layers provided by companies including Cloudflare and Akamai Technologies.

Category:Web server software