FastCGI: 30 Years Old and Still the Better Protocol for Reverse Proxies

FastCGI, the 30-year-old protocol, is argued to be a safer alternative to HTTP for reverse proxy-to-backend communication. HTTP/1.1's ambiguous framing enables desync/request-smuggling attacks, and its lack of structural separation between trusted proxy headers and untrusted client headers creates persistent security vulnerabilities. FastCGI solves both problems: it uses explicit message framing (eliminating desync), and prefixes HTTP headers with 'HTTP_' to structurally separate them from trusted proxy parameters like REMOTE_ADDR. Popular proxies (nginx, Apache, Caddy, HAProxy) support FastCGI backends, and Go's standard library makes switching trivial. Downsides include no WebSocket support, less tooling, and potentially lower throughput due to less optimization.