$ show mtrudel/bandit
Bandit is a production-grade HTTP server library for Elixir, implementing HTTP/1 (RFC 9112), HTTP/2 (RFC 9113), and WebSocket (RFC 6455) protocols. It is built on the Thousand Island connection management library and serves as the default HTTP server for the Phoenix web framework (since version 1.7.11). The library is designed for correctness, security, and performance, achieving 100% conformance in the h2spec (HTTP/2) and Autobahn (WebSocket) test suites, while outperforming alternatives like Cowboy in benchmark comparisons. Architecturally, Bandit uses a protocol-sniffing initial handler that dispatches incoming connections to either an HTTP/1 or HTTP/2 handler based on the client preface. HTTP/2 connections follow a process-per-connection model with a separate stream process for each concurrent request, while HTTP/1 and WebSocket connections operate within a single process. The library exposes a small public API centered on the `Bandit` module, which validates options and delegates to Thousand Island. Internally, it defines clear abstractions such as the `Bandit.HTTPTransport` protocol for shared transport logic, a reusable `Bandit.Extractor` state machine for frame parsing, and telemetry spans for observability. Key features include support for HTTP/1 keepalive, HTTP/2 flow control and HPACK header compression, WebSocket permessage-deflate compression, content-encoding negotiation (gzip, deflate, zstd), Unix socket binding, and comprehensive error handling with clear RFC citations. The library is actively maintained with frequent releases addressing security vulnerabilities and edge cases, and includes extensive CI workflows for conformance testing, benchmarking, and regression prevention.
The LLM identified 4 files worth highlighting for reuse:
Implements a generic state machine for extracting frames from a binary stream, used by both WebSocket and HTTP/2 frame parsing. It demonstrates a clean, reusable pattern for handling incremental data delivery and state transitions without mutable state, making it easy to extract and apply to other binary protocol parsing scenarios.
Defines a behaviour (protocol) that abstracts the common transport operations (read headers, read data, send headers, send data, sendfile) for both HTTP/1 sockets and HTTP/2 streams. This decouples the Plug adapter from protocol-specific details and allows the same `Bandit.Adapter` to work with either transport, showcasing a textbook example of polymorphism in Elixir.
Provides content-encoding negotiation and streaming compression (gzip, deflate, zstd) for HTTP responses. It is cleanly separated from the rest of the server, handling compression context setup, chunked compression, and streaming of compressed data. This module can be reused as a standalone library for streaming HTTP compression in any Elixir project.
Defines a protocol for abstracting WebSocket frame sending across different socket types (plain TCP, TLS, and HTTP/2 tunnels). It encapsulates the binary framing format and masking logic per RFC 6455, and can be extracted and used in any Elixir WebSocket implementation that needs a clean separation between frame construction and transport.