The C framework
for the web
A high-performance Linux server: HTTP/1, HTTP/2 and HTTP/3 (QUIC), WebSockets, databases and ORM out of the box — no reverse proxy, no runtime
A high-performance Linux server: HTTP/1, HTTP/2 and HTTP/3 (QUIC), WebSockets, databases and ORM out of the box — no reverse proxy, no runtime
Clone the repository, build the project with the database drivers you need and launch the server with a single command.
git clone https://github.com/fraxer/C-web-framework.git
cd C-web-framework/backend
mkdir build && cd build
cmake .. -DCMAKE_BUILD_TYPE=Release \
-DINCLUDE_POSTGRESQL=yes \
-DINCLUDE_MYSQL=yes \
-DINCLUDE_REDIS=yes \
-DINCLUDE_SQLITE=yes
cmake --build . -j$(nproc)
./exec/cwfr -c /path/to/config.json{
"/": {
"GET": {
"file": "handlers/libindexpage.so",
"function": "index"
}
}
}#include "http.h"
void index(httpctx_t* ctx) {
ctx->response->send_data(
ctx->response,
"Hello world!"
);
}A handler is just a function — Each route loads a handler from a .so library. Read the request, build the response — nothing else to wire up.
Build & run guide →A complete toolkit for modern web services — protocols, databases, security and utilities out of the box.
A hand-written QUIC stack (RFC 9000) over UDP: TLS 1.3 handshake in one RTT, no head-of-line blocking, connection migration across networks — switch from Wi-Fi to LTE and the connection survives.
Up to 100 multiplexed streams, HPACK and Rapid Reset protection.
Real-time channels with broadcasting and named groups.
Full server and client: routing, vhosts, TLS.
Four drivers behind one unified API with ORM and migrations.
PostgreSQLMySQLRedisSQLiteAuthentication, sessions and RBAC without external services.
Local FS and S3 plus transactional email with DKIM.
Template engine, i18n, JSON, JWT and the task scheduler.
Hot reload of handlers, logging, the HTTP client, scheduled tasks and more — in the docs.
Open the docs →Real container measurements: JSON processing, PostgreSQL queries and static file serving. Choose a workload to see its results and conditions.
POST /count · 1,048,576 bytes · 4,097 keys · nested objects and mixed types. One application worker, eight execution threads, identical nginx gateway and resource limits.
| Framework | req/s | p99, ms | CPU/request, µs | RSS median, MiB |
|---|---|---|---|---|
| cwfr (C) | 1,908 | 46.13 | 3,352 | 84.82 |
| Spring Boot (Java) | 1,727 | 43.92 | 4,124 | 579.70 |
| facil.io (C) | 828 | 1,896.61 | 6,802 | 37.80 |
| Laravel (PHP) | 823 | 112.99 | 9,082 | 315.58 |
| Fiber (Go) | 679 | 493.56 | 11,145 | 200.59 |
| Fastify (JavaScript) | 595 | 568.00 | 12,648 | 540.44 |
| Ruby on Rails (Ruby) | 267 | 295.04 | 4,350 | 241.94 |
| Kore + Jansson (C) | 210 | 448.16 | 21,976 | 73.18 |
| Django (Python) | 179 | 517.21 | 6,000 | 88.33 |
p99 is the 99th percentile of request latency as seen by the load client: 99% of responses arrived faster. It covers the full round trip through the gateway, including queueing, not only application CPU time.
CPU covers application containers; gateway CPU is reported separately. Server: 8 logical CPUs on 4 physical cores, 2 GiB per container. Client: separate cores, 8 threads.
RSS is the sum of resident memory of application processes, including supervisors, sampled every 200 ms during load. The table shows the median of five run medians.
Methodology, versions and results → · 2026-10-04
There is more test code than framework code. Each layer catches what the others miss: unit tests pin down behaviour, fuzzers throw garbage at every parser, and integration suites restart, reload and overload a live server.
108,104 checks in 137 files, about 5 s under AddressSanitizer; separate runners keep HTTP/2 and HTTP/3 visible.
Real SQL against PostgreSQL, each run in its own schema; suites for MySQL, Redis and SQLite too.
HTTP/1–3, HPACK, QPACK, QUIC, WebSocket, JSON, JWT and templates. The last audit ran ~183M inputs.
Hard and soft reload, QUIC migration, 0-RTT, IPv6, memory limits and soak runs against a real process.
Every HTTP/2 and HTTP/3 conformance case passes; h2load pushed 300K requests without an error.
Not one memory error or data race reported under a 400K-request load.
46,007 executable lines, gcov. Sorted by test coverage.
Fuzzing alone reaches lines no test touches; together the layers cover more than either one.
Lines of C, shell and Python, counted the same way on both sides.
How it was measured — October 1, 2026: a --coverage build of the core, the unit and DB runners, then every fuzz target for 60 s. One script, ci.sh, runs all 24 stages — from the ASan and TSan builds to h3spec.
The test suite on GitHub →High-performance APIs for mobile and web applications
Chats, notifications and live updates via WebSocket
Microservices and monolithic applications
Request routing and proxying between services
Authentication, RBAC and CRUD operations
Local and S3-compatible cloud storage
Transactional email sending with DKIM
Multilingual content with gettext and pluralization
Read the introduction, browse the examples, or open the source on GitHub.