actix-web VS hyper

To find answers, we wanted to get our hands dirty with three popular Rust web frameworks including rocket, axum, and actix, and get a feeling for their performance, features, and most importantly the developer experience.

Actix Web site: https://actix.rs/

So, what framework do I use? Zentrox uses the actix_web framework which is a great library. My DevExp. with this tool was nice. It has good documentation and powerful tools. It was easy to implement for me as I was previously using Express.JS and Flask (Python). Actix also has other helper libraries for files, cookies, sessions,... which I use in my project as well.

Not to compare but i realice this is something you can do with rust with few lines

https://github.com/actix/actix-web/tree/master/actix-http

APIs are often the key to enabling interoperability between AML/KYC solutions and other systems. Design APIs following RESTful principles—using libraries like ExpressJs (JavaScript), Flask (Python), or Actix Web (Rust)—ensuring they are stateless and support the JSON/XML formats expected by most systems. Use Swagger to generate detailed documentation for RESTful APIs to facilitate integration and ensure your APIs are easily consumable by other systems. If you’re building GraphQL APIs, using tools like Apollo Server, Prisma, or Graphene will allow for self-documenting APIs (through GraphQL introspection).

Actix Web Documentation: Detailed documentation on using Actix-web, including examples and best practices for building web applications with Rust.

I can't speak to the "is it any good" part, but (after a bit of research) I can share what I've found. I'll try to represent things as best as I understand, but I may have some finer details mixed up.

ntex is written by the same person that started actix-web, Nikolay Kim (fafhrd91 on GitHub). There was a bunch of drama a while back due to actix-web using (what many reasoned to be) avoidable unsafe code, which was later found to be buggy. Nikolay was pilloried online, resulting in him transferring leadership of actix-web to someone else. ntex is, as I understand it, essentially Nikolay picking back up on his ideals for what could have been actix-web, if people hadn't pushed him out of his own project.

How ntex compares to the pre-/post-leadership change of actix-web, I don't know.

Here are some jumping points if you want more of the backstory.

https://www.theregister.com/2020/01/21/rust_actix_web_framew...

https://steveklabnik.com/writing/a-sad-day-for-rust

https://github.com/actix/actix-web/issues/1289

In particular the last point is what sets axum apart from other frameworks axum doesn't have its own middleware system but instead uses tower::Service. This means axum gets timeouts, tracing, compression, authorization, and more, for free. It also enables you to share middleware with applications written using hyper or tonic.

The bytes crate does support what ComputerGuru asked for via the Buf trait. The trait can be implemented over a sequence of buffers but still provides functions that are common with single buffers. In fact the hyper crate uses the trait in exactly this way - it has an internal type that is a VecDeque of chunks but also implements the Buf trait.

https://docs.rs/bytes/1.9.0/bytes/buf/trait.Buf.html

https://github.com/hyperium/hyper/blob/3817a79b213f840302d7e...

> While not really the target audience for either language, I would prefer zig's crashing behavior to hyper using unsafe evaluations of macros as an example.

> https://github.com/hyperium/hyper/blob/30f2961e89eb306780d85...

This looks basically like a port of something like Kotlin or C#'s ?. operator - the macro checks whether the pointer is null, returns err if it is, and dereferences the pointer otherwise. The part highlighted in the link looks like it's part of the macro implementation - there don't seem to be any "direct" uses of that particular rule in calling code and it's only invoked via the other rules in that macro definition. I think that should make that bit null-safe at least.

Lifetime safety might be a bit trickier, especially since that bit is part of hyper's C API so idk if there's anything Rust (or Zig, for that matter) could do to ensure the pointer is still valid when dereferenced.

Hyper Crate

I'd point out that one advantage Go has over Rust in terms of security are the coverage of standard libraries. Go has great support for HTTP clients/servers, cryptography primitives, SSH, SQL, JSON, secure RNG, etc. all in officially maintained standard libraries. The Rust ecosystem has some standards here but the most widely used HTTP client, just as an example, is mostly maintained by one guy[1]. I think that adds considerable security risk vs Go's net/http.

1. https://github.com/hyperium/hyper/graphs/contributors

After I read a bit about axum [1], it says it's a relatively thin wrapper on top of hyper [2], a fast and correct HTTP library.

In other words, what can be done with NGINX, it can be achieved with axum (assuming you know Rust).

It looks interesting, I'm not going to lie!

[1] https://github.com/tokio-rs/axum

[2] https://crates.io/crates/hyper

A high-performance runtime, with a multi-threaded, asynchronous event loop written in Rust (using Tokio and Hyper).

Its core dependencies is hyper, "a protective and efficient HTTP library for all" which is rather low-level.

Mocking helper to develop microservices and APIs. hyper-based HTTP server generating REST responses containing JSON ones. Written in Rust.

> If you are equally picky and constrain yourself to parts of the ecosystem which care about binary size, you still have more options and can avoid size issues.

What's an example of this for, say, libcurl? On my system it has a tiny number of recursive dependencies, around a dozen. [0] Furthermore if I want to write a C program that uses libcurl I have to download zero bytes of data ... because it's a shared library that is already installed on my system, since so many programs already use it.

I don't really know the appropriate comparison for Rust. reqwest seems roughly comparable, but it's an HTTP client library, and not a general purpose network client like curl. Obviously curl can do a lot more. Even the list of direct dependencies for reqwest is quite long [1], and it's built on top of another http library [2] that has its own long list of dependencies, a list that includes tokio, no small library itself.

In terms of final binary size, the installed size of the curl package on my system, which includes both the command line tool and development dependencies for libcurl, is 1875.03 KiB.

[0] I'm excluding the dependency on the ca-certificates package, since this only provides the certificate chain for TLS and lots of programs rely on it.

[1] https://crates.io/crates/reqwest/0.11.24/dependencies

[2] https://crates.io/crates/hyper/0.14.28/dependencies