Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Clone of the mongoose ... with tweaks: IPv6 support across the board; extended event callbacks; client-side socket connections using [mg_]connect(); [mg_]socketpair(); porting code placed in separate .h header file for easiest re-use in your own applications which embed/use mongoose; optional pthread support.
Failed to load latest commit information.
bindings Changing API: callback doesnt get mg_request_info pointer anymore, bu…
documentation added a NO_SSL MSVC project (mostly to make sure that the build batch…
examples - fix bug: click on red close box in top-right corner would not quit …
pthread-win32 @ 9dff6a1 adding MSVC2012 project for 'book examples server' variant.
selectable-socketpair @ 169ea6e whitespace five-oh paid a visit: wsclean -e -x -U -v $(find . -type f…
test corrected pthread_create emulation; no more weird bus errors/crashes …
testclient whitespace police raid
upskirt @ dfe5e2f changed the MSVC2010 project to use the internal pthreads emulation, …
win32 changed the MSVC2010 project to use the internal pthreads emulation, …
.gitattributes gitattributes to make sure that MSVC files are CRLF and UNIX are LF-o…
.gitignore added support for MSVC2012: solution + projects are provided, also fo…
.gitmodules added wiki and vanilla mongoose wiki repositories as submodules withi…
LICENSE license added
Makefile Merge commit '518b3aa72642145a811310e2fcb2f3c1a3cb2567' + cleaned mg_…
README.markdown whitespace police raid. whitespace police raid.
main.c whitespace police raid.
mongoose.1 Implemented -x option
mongoose.c whitespace police raid.
mongoose.h whitespace police raid.
mongoose_ex.c whitespace police raid.
mongoose_ex.h working book_samples_server example. Now we need to clean up and fix …
mongoose_sys_porting.h whitespace police raid.




mongoose — lightweight web server


 mongoose [config_file] [OPTIONS]
 mongoose -A htpasswd_file domain_name user_name password


mongoose is small, fast and easy to use web server with CGI, SSL, MD5 authorization, and basic SSI support.

mongoose does not detach from terminal, and uses current working directory as the web root, unless -r option is specified. It is possible to specify multiple ports to listen on. For example, to make mongoose listen on HTTP port 80 and HTTPS port 443, one should start it as: mongoose -s cert.pem -p 80,443s

Unlike other web servers, mongoose does not require CGI scripts be put in a special directory. CGI scripts can be anywhere. CGI (and SSI) files are recognized by the file name pattern. mongoose uses shell-like glob patterns with the following syntax:

Pattern Matches ...
** Matches everything
* Matches everything but slash character, '/'
? Matches any character
$ Matches the end of the string
| Matches if pattern on the left side or the right side matches. Pattern on the left side is matched first
All other characters in the pattern match themselves.

If no arguments are given, mongoose searches for a configuration file called "mongoose.conf" in the same directory where mongoose binary is located. Alternatively, a file name could be specified in the command line. Format of the configuration file is the same as for the command line options except that each option must be specified on a separate line, leading dashes for option names must be omitted. Lines beginning with '#' and empty lines are ignored.


  • `-A htpasswd_file domain_name user_name password`

    Add/edit user's password in the passwords file. Deleting users can be done with any text editor. Functionality is similar to Apache's htdigest utility.

  • `-C cgi_pattern`

    All files that fully match cgi_pattern are treated as CGI. Default pattern allows CGI files be anywhere. To restrict CGIs to certain directory, use e.g. "-C /cgi-bin/**.cgi". Default: "**.cgi$|**.pl$|**.php$"

  • `-E cgi_environment`

    Extra environment variables to be passed to the CGI script in addition to standard ones. The list must be comma-separated list of X=Y pairs, like this: "VARIABLE1=VALUE1,VARIABLE2=VALUE2". Default: ""

  • `-G put_delete_passwords_file`

    PUT and DELETE passwords file. This must be specified if PUT or DELETE methods are used. Default: ""

  • `-I cgi_interpreter`

    Use cgi_interpreter as a CGI interpreter for all CGI scripts regardless script extension. Mongoose decides which interpreter to use by looking at the first line of a CGI script. Default: "".

  • `-M max_request_size`

    Maximum HTTP request size in bytes. Default: "16384"

  • `-P protect_uri`

    Comma separated list of URI=PATH pairs, specifying that given URIs must be protected with respected password files. Default: ""

  • `-R authentication_domain`

    Authorization realm. Default: ""

  • `-S ssi_pattern`

    All files that fully match ssi_pattern are treated as SSI. Unknown SSI directives are silently ignored. Currently, two SSI directives are supported, "include" and "exec". Default: "**.shtml$|**.shtm$"

  • `-a access_log_file`

    Access log file. Default: "", no logging is done.

  • `-d enable_directory_listing`

    Enable/disable directory listing. Default: "yes"

  • `-e error_log_file`

    Error log file. Default: "", no errors are logged.

  • `-g global_passwords_file`

    Location of a global passwords file. If set, per-directory .htpasswd files are ignored, and all requests must be authorised against that file. Default: ""

  • `-i index_files`

    Comma-separated list of files to be treated as directory index files. Default: "index.html,index.htm,index.cgi"

  • `-l access_control_list`

    Specify access control list (ACL). ACL is a comma separated list of IP subnets, each subnet is prepended by '-' or '+' sign. Plus means allow, minus means deny. If subnet mask is omitted, like "-", then it means single IP address. Mask may vary from 0 to 32 inclusive. On each request, full list is traversed, and last match wins. Default setting is to allow all. For example, to allow only 192.168/16 subnet to connect, run "mongoose -,+192.168/16". Default: ""

  • `-m extra_mime_types`

    Extra mime types to recognize, in form "extension1=type1,extension2=type2,...". Extension must include dot. Example: "mongoose -m .cpp=plain/text,.java=plain/text". Default: ""

  • `-p listening_ports`

    Comma-separated list of ports to listen on. If the port is SSL, a letter 's' must be appeneded, for example, "-p 80,443s" will open port 80 and port 443, and connections on port 443 will be SSL-ed. It is possible to specify an IP address to bind to. In this case, an IP address and a colon must be prepended to the port number. For example, to bind to a loopback interface on port 80 and to all interfaces on HTTPS port 443, use "mongoose -p,443s". Default: "8080"

  • `-r document_root`

    Location of the WWW root directory. Default: "."

  • `-s ssl_certificate`

    Location of SSL certificate file. Default: ""

  • `-t num_threads`

    Number of worker threads to start. Default: "10"

  • `-u run_as_user`

    Switch to given user's credentials after startup. Default: ""

  • `-w url_rewrite_patterns`

    Comma-separated list of URL rewrites in the form of "pattern=substitution,..." If the "pattern" matches some prefix of the requested URL, then matched prefix gets substituted with "substitution". For example, "-w /config=/etc,**.doc|**.rtf=/path/to/cgi-bin/handle_doc.cgi" will serve all URLs that start with "/config" from the "/etc" directory, and call handle_doc.cgi script for .doc and .rtf file requests. If some pattern matches, no further matching/substitution is performed (first matching pattern wins). Use full paths in substitutions. Default: ""

  • `-x hide_files_patterns`

    A prefix pattern for the files to hide. Files that match the pattern will not show up in directory listing and return 404 Not Found if requested. Default: ""


mongoose was designed to be embeddable into C/C++ applications. Since the source code is contained in single C file, it is fairly easy to embed it and follow the updates. Please refer to for details.


  • `mongoose -r /var/www -s /etc/cert.pem -p 8080,8043s`

    Start serving files from /var/www. Listen on port 8080 for HTTP, and 8043 for HTTPS connections. Use /etc/cert.pem as SSL certificate file.

  • `mongoose -l -,+,+`

    Deny connections from everywhere, allow only IP address and all IP addresses from subnet to connect.

  • `mongoose -w **=/usr/bin/script.cgi`

    Invoke /usr/bin/script.cgi for every incoming request, regardless of the URL.


mongoose is licensed under the terms of the MIT license.


Sergey Lyubka (

Something went wrong with that request. Please try again.