Installation

Requirements#

Minimum Supported Rust Version (MSRV): 1.99

Install or update Rust via rustup:

rustup update stable
rustc --version   # should print 1.99.0 or newer

As a library crate#

Add rust-web-server to your Cargo.toml:

cargo add rust-web-server

Or pin the major version manually:

[dependencies]
rust-web-server = "18"

The default feature set (http3) pulls in HTTP/3, HTTP/2, TLS, and a tokio async runtime. If you need a lighter build, opt out and select a lower feature tier (see the feature flags table below).

Prelude#

A single glob import covers the types you need in almost every handler:

use rust_web_server::prelude::*;
// Re-exports: App, Server, ConnectionInfo, Request, Response,
//             STATUS_CODE_REASON_PHRASE, Range, MimeType,
//             PathParams, New, routes!

As a standalone binary#

Every release ships prebuilt binaries, so no Rust toolchain is needed:

On Windows, rws.exe also runs as a Windows service — see Windows.

Linux binaries are statically linked against musl, so they run on any distribution regardless of glibc version. Each archive has a matching .sha256 file.

rws --version
rws --help      # every option, with its environment-variable equivalent

Run it in any directory that contains static files and it will serve them on http://localhost:7878 with no configuration file needed.

Verifying a release#

From 18.0.0, releases can be checked end to end:

# The archive was built by this repository's release workflow
gh attestation verify rws-18.0.0-x86_64-unknown-linux-musl.tar.gz --repo bohdaq/rust-web-server

# The image too — attestation, or the keyless cosign signature
gh attestation verify oci://ghcr.io/bohdaq/rws:18.0.0 --repo bohdaq/rust-web-server
cosign verify ghcr.io/bohdaq/rws:18.0.0 \
  --certificate-identity-regexp 'https://github.com/bohdaq/rust-web-server/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# Known vulnerabilities in the dependencies compiled into a binary
# (built with cargo-auditable, so the list travels with it)
cargo audit bin ./rws

Each release also has a CycloneDX SBOM (rws-<version>.cdx.json) of the binary's dependency tree. CI checks every change with cargo audit and cargo deny (advisories; permissive licenses only; crates.io sources only — deny.toml).

Build from source#

git clone https://github.com/bohdaq/rust-web-server.git
cd rust-web-server
cargo build --release
# binary is at: target/release/rws

To build a specific feature tier from source:

# HTTP/2 + TLS only (no QUIC)
cargo build --release --no-default-features --features http2

# HTTP/1.1 only — no TLS, no async runtime, smallest binary
cargo build --release --no-default-features --features http1

Feature flags#

Presets#

Since 18.32.0 four presets turn on common sets of the features below. They only enable other features, so they combine with each other and with single features:

[dependencies]
rust-web-server = { version = "18.32", features = ["api"] }
# HTTP/2 + TLS without QUIC: default-features = false, features = ["api"]

Sessions, routing, middleware, MCP, WebSocket and SSE need no feature. Add model-postgres or model-mysql beside a preset for another database.

Build times. A clean debug cargo build --lib of rust-web-server, each preset on top of the default features (http3, brotli, zstd), measured 2026-11-04 on a 4-core Linux container (rustc 1.97) with other builds sharing the CPU — read them as relative:

Rebuilds after a change to your own code only recompile your crate.

On docs.rs#

docs.rs documents the crate with full, http1 and pkcs11 — every item, each labelled with the features it needs (for example Available on crate feature sso only). fips and mimalloc add no items.

All features#

fips (since 18.23.0) builds TLS on aws-lc's FIPS 140-3 validated module and needs CMake and Go; see FIPS 140-3. pkcs11 (since 18.23.0) lets tls_key_file name a key on an HSM or cloud KMS; see PKCS#11.

rust-web-server = { version = "18", default-features = false, features = ["http2", "serde", "model-sqlite"] }

Approximate binary sizes#

These measurements are for a release build (cargo build --release) of the rws binary with only the core transport feature active. Enabling additional features (serde, tera, ORM backends, etc.) increases the size.

What's built in, and what isn't#

HTTP/1.1 parsing, CORS, MIME types, range requests, WebSocket, SSE, and routing are implemented inside this crate. The transitive dependency tree has no hyper, tower, or actix-net.

The HTTP/2 server is rws's own (h2_server: framing, HPACK, flow control — conformance-checked with h2spec and fuzzed); the h2 crate remains a dependency as the HTTP/2 client of H2ReverseProxy/GrpcProxy. HTTP/3 and QUIC use h3 and quinn, and TLS uses rustls. tokio-util appears transitively in the default build through h2.