Overview of new features in Apache HTTP Server 2.4

Core Enhancements

KeepAliveTimeout in milliseconds

It is now possible to specify KeepAliveTimeout in milliseconds.

Loadable MPMs

Multiple MPMs can now be built as loadable modules at compile time. The MPM of choice can be configured at run time.

Per-module and per-directory LogLevel configuration

The LogLevel can now be configured per module and per directory. New levels trace1 to trace8 have been added above the debug log level.

Module Enhancements

mod_ssl

mod_ssl can now be configured to use an OCSP server to check the validation status of a client certificate. The default responder is configurable, along with the decision on whether to prefer the responder designated in the client certificate itself.

mod_ssl now also supports OCSP stapling, where the server pro-actively obtains an OCSP verification of its certificate and transmits that to the client during the handshake.

mod_ssl can now be configured to share SSL Session data between servers through memcached

mod_lua

Embeds the Lua language into httpd, for configuration and small business logic functions.

mod_proxy

The ProxyPass directive is now most optimally configured within a Location or LocationMatch block, and offers a significant performance advantage over the traditional two-parameter syntax when present in large numbers.

mod_proxy_fcgi

FastCGI Protocol backend for mod_proxy

mod_cache

mod_cache can now cache HEAD requests.

Where possible, mod_cache directives can now be set per directory, instead of per server.

The base URL of cached URLs can be customised, so that a cluster of caches can share the same endpoint URL prefix.

mod_cache is now capable of serving stale cached data when a backend is unavailable (error 5xx).

mod_cache can now insert HIT/MISS/REVALIDATE into an X-Cache header.

mod_allowmethods

New module to restrict certain HTTP methods without interfering with authentication or authorization.

mod_include

Support for the 'onerror' attribute within an 'include' element, allowing an error document to be served on error instead of the default error string.

mod_cgi, mod_include, mod_isapi, ...

Translation of headers to environment variables is more strict than before to mitigate some possible cross-site-scripting attacks via header injection. Headers containing invalid characters (including underscores) are now silently dropped. Environment Variables in Apache has some pointers on how to work around broken legacy clients which require such headers. (This affects all modules which use these environment variables.)

Program Enhancements

fcgistarter

FastCGI deamon starter utility

htcacheclean

Current cached URLs can now be listed, with optional metadata included.

Allow explicit deletion of individual cached URLs from the cache.

File sizes can now be rounded up to the given block size, making the size limits map more closely to the real size on disk.

Cache size can now be limited by the number of inodes, instead of or in addition to being limited by the size of the files on disk.

Module Developer Changes

Check Configuration Hook Added

A new hook, check_config, has been added which runs between the pre_config and open_logs hooks. It also runs before the test_config hook when the -t option is passed to httpd. The check_config hook allows modules to review interdependent configuration directive values and adjust them while messages can still be logged to the console. The user can thus be alerted to misconfiguration problems before the core open_logs hook function redirects console output to the error log.

Expression Parser Added

We now have a general-purpose expression parser, whose API is exposed in ap_expr.h. This is adapted from the expression parser previously implemented in mod_include.

Authorization Logic Containers

Advanced authorization logic may now be specified using the Require directive and the related container directives, such as <RequireAll>, all provided by the mod_authz_core module.

Small-Object Caching Interface

The ap_socache.h header exposes a provider-based interface for caching small data objects, based on the previous implementation of the mod_ssl session cache. Providers using a shared-memory cyclic buffer, disk-based dbm files, and a memcache distributed cache are currently supported.

Cache Status Hook Added

The mod_cache module now includes a new cache_status hook, which is called when the caching decision becomes known. A default implementation is provided which adds an optional X-Cache and X-Cache-Detail header to the response.

The developer documentation contains a detailed list of API changes.