Nepedia
Back to Discover
Advanced Reader
💻

Common Gateway Interface

technology Maturity 9-11 Next article →

The Common Gateway Interface, or CGI, is a vital specification for web computing. It allows a web server to execute external programs to process user requests sent via HTTP or HTTPS. In the early days of the internet, web servers were mostly used to send static files. These files, like a simple text document or a picture, do not change. CGI changed this by allowing the server to create pages on the fly. This makes the web interactive rather than just a collection of digital books.

Common Gateway Interface logo
Common Gateway Interface logo

To understand the mechanism, we must look at how a request moves through a system. When a user interacts with a web page, such as clicking a submit button on a form, the browser sends an HTTP request to the server. This request contains specific data from the user. The web server receives this and launches a CGI script as a new computer process. The server passes the user's data to the script using environment variables or standard input. For example, if a user sends a query string, it is stored in a variable called QUERY_STRING. The script processes this data and produces an output, which is usually HTML code. The web server then takes this output and relays it back to the user's browser as a response.

CGI programs can be categorized by how they are written and executed. Many are called CGI scripts because they are written in scripting languages. However, they can also be compiled programs written in languages like C. Historically, C was very common for this work. The specification RFC 3875 even uses C to define how environment variables are accessed. Another way to categorize them is by their deployment method. Some servers use a special directory, often named cgi-bin, to keep executable files secure. Others identify scripts by using specific filename extensions, such as .cgi. While convenient, using extensions can sometimes create security risks if a user uploads malicious code.

Common Gateway Interface logo
Common Gateway Interface logo

The history of CGI is rooted in the early 1990s. In 1993, a team from the National Center for Supercomputing Applications (NCSA) wrote the first specification. They shared it on the www-talk mailing list to help developers call command line executables. Because it was so useful, other web server developers adopted it quickly. In November 1997, a work group chaired by Ken Coar began formalizing the NCSA definition. This effort resulted in RFC 3875, which established CGI Version 1.1. This document included contributions from many experts, such as Rob McCool, John Franks, Ari Luotonen, Tony Sanders, and George Phillips.

The name "gateway" reveals the original purpose of this technology. In the early web era, webmasters needed to connect modern web servers to legacy information systems. These older systems often included large, complex databases. CGI acted as the bridge, or gateway, between the new web interface and the old data systems. A common modern example is a wiki. When a user requests a wiki page, a CGI program retrieves the source data, transforms it into HTML, and displays it. If the user clicks an edit button, the program can then update the source and save the changes back to the system.

Despite its importance, CGI has a significant technical limitation regarding efficiency. For every single incoming request, the web server must create a new process and then destroy it once the work is done. This constant starting and stopping consumes a lot of CPU time and memory. If a website receives a very high number of requests, this overhead can overwhelm the server. To solve this, developers created several alternatives. Some use web server extensions, like Apache modules, to keep processes running longer. Others use protocols like FastCGI, SCGI, or AJP. These allow application processes to stay active and listen on a socket, which uses much less memory than the standard CGI method.

Common Gateway Interface logo
Common Gateway Interface logo

Security is another critical aspect of using CGI. Because these scripts run in the security context of the web server, they must be handled carefully. In early 1996, a widespread security issue occurred involving a script called PHF. This script was intended to be a simple phone book, but it did not properly sanitize user input. This allowed attackers to perform what is known as a code injection attack. By passing specific characters, an attacker could run unauthorized commands on the server. This event served as a major lesson for the computing world about the dangers of unsanitized data. Today, CGI remains a foundational concept that connects the user to the complex systems running behind every website.

756 words

Where will your curiosity go next?

Keep exploring at your chosen reading level.

🖼️ Images & Media (1)
File:Common Gateway Interface logo.svg
Common Gateway Interface logo.svg
More to explore

🔬 Go deeper

More advanced topics to explore

🪜 Step back

Simpler topics to build understanding

What is Nepedia?

A free, ad-free encyclopedia for children. Every article is written at five reading levels, so the same page works for a five-year-old and a fifteen-year-old — use the level switcher above to see this one change. No account needed to read.