CWIST: A C17 web framework with HTTP/3, WebTransport, and post-quantum TLS

What it does

CWIST is a C17 web framework and application server designed for developers who need raw performance and modern transport protocols without leaving the C ecosystem. It supports HTTP/1.1, HTTP/2, and HTTP/3 (QUIC), along with WebSocket and WebTransport. Security features include hybrid post-quantum TLS using X25519MLKEM768. The framework includes an embedded SQLite ORM and uses a synchronous reactor based on io_uring, epoll, or kqueue depending on the OS.

It offers two distinct server modes controlled by environment variables. The default "reactor" mode multiplexes connections to maximize throughput by decoupling connection counts from thread usage. The alternative "Classic pool" mode assigns one thread per connection, which documentation states can reduce median request latency significantly compared to certain other frameworks like Axum in specific benchmarks. These performance figures are noted as dependent on CPU models and load profiles, not universal guarantees.

Who it helps

This tool targets systems programmers and backend developers building high-concurrency services where memory footprint and execution speed are critical. It suits teams already comfortable with C who want native support for next-generation web standards like WebTransport and post-quantum cryptography without relying on heavier runtimes. The inclusion of vendored dependencies makes it attractive for environments requiring static linking and minimal external library management.

Getting started

Building CWIST requires cloning the repository and running make. Dependencies such as BoringSSL, lsquic, libttak, and SQLite3 are vendored, allowing a plain build on fresh Linux, macOS, or BSD machines. Installation to /usr/local is optional via sudo make install, or users can specify a custom prefix. macOS and Linux users can also install via Homebrew using the official tap. Compilation involves linking against libcwist.a and several other libraries including SSL, crypto, and compression tools. Tutorials and hands-on modules are available in the project's tutorials/ directory to guide initial implementation.

Limits and costs

CWIST is distributed under the MIT license, permitting free use, modification, and distribution. However, as an open-source project, it carries no commercial support or warranty. Performance claims rely on specific benchmark conditions documented in the README; actual results may vary based on hardware and workload. The requirement for manual compilation and static linking adds setup overhead compared to interpreted languages or package-managed ecosystems. Developers must manage their own security updates for vendored libraries unless provided by upstream releases.

Source links

• Official repository: https://github.com/c4punks/cwist
• Project documentation: https://github.com/c4punks/CWIST/blob/main/README.md
• Project license: https://github.com/c4punks/CWIST/blob/main/LICENSE