Embedding a web server in a product is a potent mechanism for easily implementing various key features and functions in your device. One of the greatest benefits of an embedded web server is that it resides in the equipment itself and not as a separate software that needs to be installed on a computer. A user can use a browser and navigate to the IP address or domain name given to access key features in the product.
In this article, we look into a few use cases where embedding a web server in a product is not optimal, but a hybrid IoT/cloud solution creates a much better user experience.
Products powered by small microcontrollers, such as ARM Cortex M4, that mandate using secure HTTPS web servers are problematic since modern web browsers may attempt to pre-allocate as many as 12 connections before sending the first GET request. Each connection requires its own time-consuming TLS handshake.
HTTPS connections are problematic for small devices. Modern browsers may pre-allocate many TLS connections before sending the first GET request. A small WebServer may be designed to handle one connection at a time, and this works with nonsecure HTTP connections but not with HTTPS connections. It does not work with secure connections because each SSL connection requires its own time-consuming TLS handshake (asymmetric encryption) before it moves up to the HTTP layer. This means that the connections opened by the browser must complete a full TLS handshake, even if they are not used. In particular, some browsers make the handshake very time-consuming since they open many connections (pre-allocate TLS connections) without waiting for at least one to complete the handshake so subsequent connections can use TLS session resumption.
The asymmetric encryption the TLS handshake uses is CPU intensive. A small device can manage one TLS handshake in a reasonable amount of time, but not 12. A device is at the mercy of the browser and has no way of telling the browser that it cannot cope with that many connections. A solution would be to move to HTTP/2, but the HTTP/2 protocol has its issues and complexities making it unsuitable for small devices.
To remedy this problem, two distinct options are suggested:
- Option 1: Implement a WebSocket Server, which provides more efficient, real-time data transfer compared to traditional web servers.
- Option 2: Integrate a low-cost ESP32-S3 microcontroller as a co-processor, and utilize the Xedge32 IoT and web development environment for a seamless easy to use non-C programming environment.
Devices and other products with an embedded web server normally operate on private networks like Intranets. Private networks are not directly accessible via the Internet and are shielded from external Internet access by a firewall/router. For example, even the most basic home router shields any server solution from external Internet access.
In many cases, preventing external access is beneficial since the embedded web server is protected from potentially malicious external users. However, it creates a major problem if the product with the embedded web server needs to be operated from another network via the Internet. This type of remote access could be anything from remote management and supervision to updating the device firmware.
External access to one web server on a private network is technically possible by opening a pinhole in the firewall. In computer networking, a firewall pinhole is a port that is not protected by a firewall to allow a particular application to gain access to a service on a host in the network protected by the firewall.
How to set up a firewall pinhole depends on the firewall product being used. However, regardless of firewall type, setting up a pinhole such as port forwarding is generally complicated and requires extensive network experience. Unless your customers are very tech-savvy, setting up port forwarding will be near to impossible for them to configure. Customers deploying your products in corporate environments may have IT personnel with the required expertise, but corporate environments typically ban the use of pinholes.
SharkTrustX is a free product that automates accessing any number of HTTP servers behind firewalls.
Our seasoned experts are ready to tackle your most pressing networking, security, and device management challenges. And if you're fueled by the DIY spirit, our rich collection of tutorials awaits to guide you. With us, you get the best of both worlds. Your project, our dedication.
Expedite your IoT and edge computing development with the "Barracuda App Server Network Library", a compact client/server multi-protocol stack and IoT toolkit with an efficient integrated scripting engine. Includes Industrial Protocols, MQTT client, SMQ broker, WebSocket client & server, REST, AJAX, XML, and more. The Barracuda App Server is a programmable, secure, and intelligent IoT toolkit that fits a wide range of hardware options.
SharkSSL is the smallest, fastest, and best performing embedded TLS stack with optimized ciphers made by Real Time Logic. SharkSSL includes many secure IoT protocols.
SMQ lets developers quickly and inexpensively deliver world-class management functionality for their products. SMQ is an enterprise ready IoT protocol that enables easier control and management of products on a massive scale.
SharkMQTT is a super small secure MQTT client with integrated TLS stack. SharkMQTT easily fits in tiny microcontrollers.
An easy to use OPC UA stack that enables bridging of OPC-UA enabled industrial products with cloud services, IT, and HTML5 user interfaces.
Use our user programmable Edge-Controller as a tool to accelerate development of the next generation industrial edge products and to facilitate rapid IoT and IIoT development.
Learn how to use the Barracuda App Server as your On-Premises IoT Foundation.
The compact Web Server C library is included in the Barracuda App Server protocol suite but can also be used standalone.
The tiny Minnow Server enables modern web server user interfaces to be used as the graphical front end for tiny microcontrollers. Make sure to check out the reference design and the Minnow Server design guide.
Why use FTP when you can use your device as a secure network drive.
PikeHTTP is a compact and secure HTTP client C library that greatly simplifies the design of HTTP/REST style apps in C or C++.
The embedded WebSocket C library lets developers design tiny and secure IoT applications based on the WebSocket protocol.
Send alarms and other notifications from any microcontroller powered product.
The RayCrypto engine is an extremely small and fast embedded crypto library designed specifically for embedded resource-constrained devices.
Real Time Logic's SharkTrust™ service is an automatic Public Key Infrastructure (PKI) solution for products containing an Embedded Web Server.
The Modbus client enables bridging of Modbus enabled industrial products with modern IoT devices and HTML5 powered HMIs.