SimpleW.Service.Firewall v26.0.1

SimpleW.Service.Firewall v26.0.1 is a maintenance release focused on handler-level firewall rules, better country-based filtering, and a cleaner configuration model.

Fixes

• Fix country deny rules so unresolved countries can be denied through CountryRule.Unknown() and FirewallDenyUnknownCountryAttribute. (#379)
• Fix country rule evaluation so handler-level country attributes trigger country resolution even when no global country rules are configured.
• Normalize MaxMindCountryDbPath and validate firewall configuration before publishing it to the running module.

Features

• Add handler metadata attributes to declare firewall rules directly on controllers and methods (#383):
  • FirewallAllowIpAttribute
  • FirewallDenyIpAttribute
  • FirewallAllowCountryAttribute
  • FirewallDenyCountryAttribute
  • FirewallAllowUnknownCountryAttribute
  • FirewallDenyUnknownCountryAttribute
  • FirewallRateLimitAttribute
• Add FirewallRateLimitWindowUnit to configure attribute-based rate-limit windows in milliseconds, seconds, minutes, or hours.
• Allow controller-level and method-level firewall metadata to be combined.
• Allow UseFirewallModule(...) to update the firewall configuration while installing the middleware only once per server.

changed

• Replace path-based firewall overrides with handler metadata rules.
• Handler firewall metadata now replaces global allow/deny/country rules for the decorated handler.
• Handler rate-limit metadata overrides the global rate limit; when no handler rate limit is declared, the global rate limit still applies.
• Move rate limiting, rule evaluation, policy resolution, telemetry, and GeoIP country resolution into dedicated internal components.
• Update documentation and README examples to use handler attributes instead of PathRule.

Breaking Changes

• PathRule / PathRules has been removed. Use firewall attributes on controller classes, controller methods, or non-inline delegate methods.
• Static files, fallback routes, and inline lambdas cannot carry C# attributes directly. Protect those routes with global firewall rules, or route them through decorated handlers.

SimpleW v26.0.1

One month after the first v26 release, SimpleW v26 gets its first maintenance update with a nice batch of fixes and improvements focused on stability, performance.

Fixes

• fix(SimpleW): stack overflow on synchronous socket accepts under heavy load (#385)
   

Features

• feature(SimpleW): add new Authorize options in StaticFiles, ServerSentEvents and WebSocket modules (#381)
• feature(SimpleW): improve TLS performances (#384)
• feature(SimpleW): StaticFileModule caches compressed variant (#386)
• feature(SimpleW): call Router.NormalizeHost() only if a host route exists (#387)
• feature(SimpleW): ignore case when searching for host route (#388)
• feature(SimpleW): support CompressedDiskCache in StaticFilesModule (#391)

Final Words

As always, we recommend updating to the latest release.

SimpleW.Helper.DependencyInjection v26.0.1

Maintenance
 

fix

 

• fix(SimpleW.Helper.DependencyInjection): exception when delegate return Task/ValueTask with object (#382)

SimpleW v26

After months of rewrite, testing, release candidates, breaking changes, documentation work, and a few painful but necessary design decisions, SimpleW v26 is finally ready.

This release is not just an update. It is a complete rewrite of SimpleW.

The old version was built on top of NetCoreServer, mostly through overrides and custom extensions. It worked, it was fast, and it served the project well for a long time. But over time, SimpleW needed its own HTTP architecture: something simpler, cleaner, easier to extend, and easier to maintain.

So v26 was rebuilt from scratch.

The result is a smaller and more explicit core, still focused on performance, but now designed around SimpleW's own model: middleware, modules, addons, a cleaner request/response lifecycle, better routing, better observability, stronger request protection, and a much better foundation for real applications.

Highlights

• Complete rewrite from scratch
• New middleware and module architecture
• New addon ecosystem
• Cleaner routing, including host-based routing
• Sync and async handlers with request cancellation
• Better static files support with cache, Last-Modified, ETag and Content-Range
• WebSocket and SSE modules with room-based broadcasting
• New Principal / Identity authentication model
• Logging, traces, metrics and enrichment per server instance
• Better malformed request protection
• Easier extensibility with custom router and engine support
• Updated documentation and migration guide

Several addons are already available, including BasicAuth, Jwt, OpenID, Firewall, Hosting, Razor, Swagger, LetsEncrypt, Templates, Serilog, Log4net and Dependency Injection.

SimpleW v26 is now minimal by default, fast by design, and much easier to compose for production applications.

Thank you to everyone who followed the rewrite, tested the prereleases, read the documentation, reported issues, or simply waited patiently.

Now the real fun begins at https://simplew.net/

breakingChange

There is a complete migration guide.

feature / comparison

Feature / Aspect	SimpleW v16 (old)	SimpleW v26 (new)
NET runtime	NET8	NET8 but should consider NET9/NET10 for better perfs and RAM usage under heavy load (e.g: NET8 400Mo, NET9 100Mo, NET10 70Mo)
Core architecture	⚠️ (tied to NetCoreServer)	✅ from scratch (custom, simple, clean)
Code readability	⚠️	✅
Overall design philosophy	⚠️ wrapper	✅ minimal, custom, fast
Long-term maintainability	⚠️ harder	✅ much easier
Performance	✅ (very high)	✅ (very high)
Middleware	❌	✅
Modules	❌	✅
Extensibility	⚠️ (callback, subclass)	✅ middleware, module, callback, subclass
Custom Router / Engine	❌	✅ UseRouter(), UseEngine()
Response Builder	✅(status, contentType, headers, body, cookies)	✅ (status, contentType, contentLength, headers, body, cookies, compression)
Result Handler	❌	✅ configurable response pipeline
Handler (Expression Tree)	✅ sync ❌async	✅ sync ✅ async + RequestAborted
Handler metadata	❌	✅ metadata attributes for middleware and addons
Routing	✅ (minimal, attribute, querystring, regexp, path, wildcard)	✅ (minimal, attribute, querystring, path, wildcard, host)
Minimal API	✅	✅
Controllers	✅	✅
Dependency Injection	❌	✅ (using the Dependency Injection addon)
SSL / HTTPS	✅ (SslContext)	✅ (SslContext, mutual authentication)
WebSocket	✅ (full broadcast)	✅ (smart broadcast using "rooms")
Server-Sent Events (SSE)	✅	✅ (smart broadcast using "rooms")
Unix socket	✅	✅
Static files	✅ (Cache, FileWatcher)	✅ (Cache, FileWatcher, Last-Modified, Etag)
Cross-Origin Resource Sharing (CORS)	✅	✅
Body parsing (JSON)	✅	✅
Body parsing (form-urlencoded)	✅	✅
Body parsing (multipart/form-data)	✅	✅ + streaming parser
Bag	❌	✅ (share data between middleware)
Auth	⚠️ custom IWebUser	✅ Principal / Identity
Custom JSON engine	✅	✅
HTTP pipelining	❌	✅
Content Range	❌	✅
Idle Timeout	❌	✅
Request Protection	❌	✅(malformed)
Observability	✅ (traces) & global to all processes	✅ (traces, metrics, enrich) per SimpleWServer instance
Logging	❌	✅ sinks, levels, lazy logging, bridges
Listener reload	❌	✅ ReloadListenerAsync()
Documentation	✅	✅ simplew.net
Tests	✅	✅ (more tests)
Support	❌	✅ Discord
Addons	❌	✅ BasicAuth, Chaos, Firewall, Hosting, Jwt, Latency, Log4net, OpenID, Razor, Swagger, LetsEncrypt, Templates, Serilog, DependencyInjection, Newtonsoft

Release Candidate 5

State of the Rewrite

A new Release Candidate is available due to a breaking change, in a few addons only :

• Jwt : Helper & Service
• BasicAuth : Helper & Service (this is a new nuget package and is no longer part of the core)
• OpenID : Helper & Service

Why?

Last week, I was finalizing the code and documentation for the release. I wanted to create a showcase for a common real-world use case: supporting multiple authentication schemes based on criteria like (host, IP, etc.).

When I tried to implement the example, the design turned out to be… ugly. A complete failure ! And not a small one.

The upcoming v26 must have solid, bulletproof foundations and be easily extensible.

At that point, releasing was not an option. Something had to change. So I took a step back and looked at how other frameworks handle this. The result:

• Handler attributes
• Authentication middleware

Thanks to this, my scenario is now handled in a clean, elegant, and powerful way. I’ll be shipping it in the templates NuGet package.

And there’s more : UseRouter(), UseEngine()

These two configuration methods allow you to easily override the Router and the Engine. Another building block for SimpleW’s extensibility.

I'm polishing the code a bit more and running tests, so I’ve postponed the release by another week. I don’t see any other parts of the code that require that level of rewriting, so I expect things to be calm. The release is planned for next week.

Read the updated documentation

feature / comparison

Feature / Aspect	SimpleW v16 (old)	SimpleW v26 (new)
NET runtime	NET8	NET8 but should consider NET9/NET10 for better perfs and RAM usage under heavy load (e.g: NET8 400Mo, NET9 100Mo, NET10 70Mo)
Core architecture	⚠️ (tied to NetCoreServer)	✅ from scratch (custom, simple, clean)
Code readability	⚠️	✅
Overall design philosophy	⚠️ wrapper	✅ minimal, custom, fast
Long-term maintainability	⚠️ harder	✅ much easier
Performance	✅ (very high)	✅ (very high)
Middleware	❌	✅
Modules	❌	✅
Extensibility	⚠️ (callback, subclass)	✅ middleware, module, callback, subclass
Response Builder	✅(status, contentType, headers, body, cookies)	✅ (status, contentType, contentLength, headers, body, cookies, compression)
Handler (Expression Tree)	✅ sync ❌async	✅ sync ✅ async + RequestAborted
Routing	✅ (minimal, attribute, querystring, regexp, path, wildcard)	✅ (minimal, attribute, querystring, path, wildcard, host)
Minimal API	✅	✅
Controllers	✅	✅
Custom attribute	❌	✅
SSL / HTTPS	✅ (SslContext)	✅ (SslContext, mutual authentication)
WebSocket	✅ (full broadcast)	✅ (smart broadcast using "rooms")
Server-Sent Events (SSE)	✅	✅ (smart broadcast using "rooms")
Unix socket	✅	✅
Static files	✅ (Cache, FileWatcher)	✅ (Cache, FileWatcher, Last-Modified, Etag)
Cross-Origin Resource Sharing (CORS)	✅	✅
Body parsing (JSON)	✅	✅
Body parsing (form-urlencoded)	✅	✅
Body parsing (multipart/form-data)	✅	✅
Bag	❌	✅ (share data between middleware)
Auth	⚠️ custom IWebUser	✅ Principal / Identity
Custom JSON engine	✅	✅
HTTP pipelining	❌	✅
Content Range	❌	✅
Idle Timeout	❌	✅
Request Protection	❌	✅(malformed)
Observability	✅ (traces) & global to all processes	✅ (traces, metrics, enrich) per SimpleWServer instance
Logging	❌	✅
Documentation	✅	✅ simplew.net
Tests	✅	✅ (more tests)
Support	❌	✅ Discord
Addons	❌	✅ BasicAuth, Chaos, Firewall, Hosting, Jwt, Latency, Log4net, OpenID, Razor, Swagger, LetsEncrypt, Templates, Serilog, Log4net

Release Candidate 4

State of the Rewrite

A new Release Candidate is available due to a breaking change : WebSocketEnvelope has been refactored (see documentation).

Other changes :

• improved performance of the StaticFilesModule and WebSocketModules. SimpleW is now in the top 3 at Http-Arena that is AWESOME !!😁
• fixed HttpRequestParser to be more RFC compliant
• Request and Response now support Content-Range, which allows to seek video position during streaming.
• added a few Telemetry metrics

I believe this will be the last RC. Some modules originally planned for v26 will be postponed, as they need more time. The core of v26 is now very stable, so it makes sense to release it.

I’d just like to make a few changes so that the router becomes easily extensible, which isn’t the case yet.

feature / comparison

Feature / Aspect	SimpleW v16 (old)	SimpleW v26 (new)
NET runtime	NET8	NET8 but should consider NET9/NET10 for better perfs and RAM usage under heady load (e.g: NET8 400Mo, NET9 100Mo, NET10 70Mo)
Core architecture	⚠️ (tied to NetCoreServer)	✅ from scratch (custom, simple, clean)
Code readability	⚠️	✅
Overall design philosophy	⚠️ wrapper	✅ minimal, custom, fast
Long-term maintainability	⚠️ harder	✅ much easier
Performance	✅ (very high)	✅ (very high)
Middleware	❌	✅
Modules	❌	✅
Extensibility	⚠️ (callback, subclass)	✅ middleware, module, callback, subclass
Response Builder	✅(status, contentType, headers, body, cookies)	✅ (status, contentType, contentLength, headers, body, cookies, compression)
Handler (Expression Tree)	✅ sync ❌async	✅ sync ✅ async + RequestAborted
Routing	✅ (minimal, attribute, querystring, regexp, path, wildcard)	✅ (minimal, attribute, querystring, path, wildcard, host)
Minimal API	✅	✅
Controllers	✅	✅
SSL / HTTPS	✅ (SslContext)	✅ (SslContext, mutual authentication)
WebSocket	✅ (full broadcast)	✅ (smart broadcast using "rooms")
Server-Sent Events (SSE)	✅	✅ (smart broadcast using "rooms")
Basic Auth	❌	✅
Unix socket	✅	✅
Static files	✅ (Cache, FileWatcher)	✅ (Cache, FileWatcher, Last-Modified, Etag)
Cross-Origin Resource Sharing (CORS)	✅	✅
Body parsing (JSON)	✅	✅
Body parsing (form-urlencoded)	✅	✅
Body parsing (multipart/form-data)	✅	✅
Bag	❌	✅ (share data between middleware)
Auth	⚠️ custom IWebUser	✅ Principal / Identity
Custom JSON engine	✅	✅
HTTP pipelining	❌	✅
Idle Timeout	❌	✅
Request Protection	❌	✅(malformed)
Observability	✅ (traces) & global to all processes	✅ (traces, metrics, enrich) per SimpleWServer instance
Logging	❌	✅
Documentation	✅	✅ simplew.net
Tests	✅	✅ (more tests)
Support	❌	✅ Discord
Addons	❌	✅ Chaos, Firewall, Hosting, Jwt, Latency, Log4net, OpenID, Razor, Swagger, LetsEncrypt, Templates, Serilog, Log4net

Release Candidate 3

State of the Rewrite

A new Release Candidate is available due to a breaking change : IWebUser has been replaced with HttpPrincipal and HttpIdentity.

Why?

The old IWebUser has existed since the first release. Quite frankly, I don’t think anyone else ever used it except myself, as it was poorly designed and mostly a legacy of a previous system (yeah EmbedIO, I'm looking at you ^^).

With the upcoming version, and considering the significant effort put into easing migration from ASP.NET Core, this weak part needed a complete redesign.

So here we go with a new security Principal, heavily inspired by (but not identical to) ASP.NET Core’s principal model. All modules have been updated to support this new core security feature, and everything is now much better integrated.

I hope this is the last breaking change of this RC phase, which is of course still ongoing. Once I’ve migrated my main SaaS to its new Principal, things will accelerate quickly toward the official release.

Final words : I also have three very promising new modules in alpha. One of them is absolutely critical for most companies using ASP.NET Core, often the main reason why migrations to alternative solutions don’t happen. I want to break that barrier and I will !

feature / comparison

Feature / Aspect	SimpleW v16 (old)	SimpleW v26 (new)
NET runtime	NET8	NET8 but should consider NET9/NET10 for better perfs and RAM usage under heady load (e.g: NET8 400Mo, NET9 100Mo, NET10 70Mo)
Core architecture	⚠️ (tied to NetCoreServer)	✅ from scratch (custom, simple, clean)
Code readability	⚠️	✅
Overall design philosophy	⚠️ wrapper	✅ minimal, custom, fast
Long-term maintainability	⚠️ harder	✅ much easier
Performance	✅ (very high)	✅ (very high)
Middleware	❌	✅
Modules	❌	✅
Extensibility	⚠️ (callback, subclass)	✅ middleware, module, callback, subclass
Response Builder	✅(status, contentType, headers, body, cookies)	✅ (status, contentType, contentLength, headers, body, cookies, compression)
Handler (Expression Tree)	✅ sync ❌async	✅ sync ✅ async + RequestAborted
Routing	✅ (minimal, attribute, querystring, regexp, path, wildcard)	✅ (minimal, attribute, querystring, path, wildcard, host)
Minimal API	✅	✅
Controllers	✅	✅
SSL / HTTPS	✅ (SslContext)	✅ (SslContext, mutual authentication)
WebSocket	✅ (full broadcast)	✅ (smart broadcast using "rooms")
Server-Sent Events (SSE)	✅	✅ (smart broadcast using "rooms")
Basic Auth	❌	✅
Unix socket	✅	✅
Static files	✅ (Cache, FileWatcher)	✅ (Cache, FileWatcher, Last-Modified, Etag)
Cross-Origin Resource Sharing (CORS)	✅	✅
Body parsing (JSON)	✅	✅
Body parsing (form-urlencoded)	✅	✅
Body parsing (multipart/form-data)	✅	✅
Bag	❌	✅ (share data between middleware)
Auth	⚠️ custom IWebUser	✅ Principal / Identity
Custom JSON engine	✅	✅
HTTP pipelining	❌	✅
Idle Timeout	❌	✅
Request Protection	❌	✅(malformed)
Observability	✅ (traces) & global to all processes	✅ (traces, metrics, enrich) per SimpleWServer instance
Logging	❌	✅
Documentation	✅	✅ simplew.net
Tests	✅	✅ (more tests)
Support	❌	✅ Discord
Addons	❌	✅ Chaos, Firewall, Hosting, Jwt, Latency, Log4net, OpenID, Razor, Swagger, LetsEncrypt, Templates, Serilog, Log4net

Release Candidate 2

State of the Rewrite

A new Release Candidate due to a breaking change in the RouteAttribute.

Why ?

1. Only method and path are mandatory. All other properties are optional, which enables future extensions without breaking the API.
2. I finally added Host filtering in the RouteAttribute: it is now possible to target a method depending on the Host.

I also added some checks to detect and stop slow performance attacks on Request.

These two changes require an extended testing period to detect any regressions.

feature / comparison

Feature / Aspect	SimpleW v16 (old)	SimpleW v26 (new)
NET runtime	NET8	NET8 but should consider NET9/NET10 for better perfs and RAM usage under heady load (e.g: NET8 400Mo, NET9 100Mo, NET10 70Mo)
Core architecture	⚠️ (tied to NetCoreServer)	✅ from scratch (custom, simple, clean)
Code readability	⚠️	✅
Overall design philosophy	⚠️ wrapper	✅ minimal, custom, fast
Long-term maintainability	⚠️ harder	✅ much easier
Performance	✅ (very high)	✅ (very high)
Middleware	❌	✅
Modules	❌	✅
Extensibility	⚠️ (callback, subclass)	✅ middleware, module, callback, subclass
Response Builder	✅(status, contentType, headers, body, cookies)	✅ (status, contentType, contentLength, headers, body, cookies, compression)
Handler (Expression Tree)	✅ sync ❌async	✅ sync ✅ async + RequestAborted
Routing	✅ (minimal, attribute, querystring, regexp, path, wildcard)	✅ (minimal, attribute, querystring, path, wildcard, host)
Minimal API	✅	✅
Controllers	✅	✅
SSL / HTTPS	✅ (SslContext)	✅ (SslContext, mutual authentication)
WebSocket	✅ (full broadcast)	✅ (smart broadcast using "rooms")
Server-Sent Events (SSE)	✅	✅ (smart broadcast using "rooms")
Basic Auth	❌	✅
JWT auth	✅	✅
Unix socket	✅	✅
Static files	✅ (Cache, FileWatcher)	✅ (Cache, FileWatcher, Last-Modified, Etag)
Cross-Origin Resource Sharing (CORS)	✅	✅
Body parsing (JSON)	✅	✅
Body parsing (form-urlencoded)	✅	✅
Body parsing (multipart/form-data)	✅	✅
Bag	❌	✅ (share data between middleware)
WebUser / Identity	✅	✅
Custom JSON engine	✅	✅
HTTP pipelining	❌	✅
Idle Timeout	❌	✅
Request Protection	❌	✅(malformed)
Observability	✅ (traces) & global to all processes	✅ (traces, metrics, enrich) per SimpleWServer instance
Logging	❌	✅
Documentation	✅	✅ simplew.net
Tests	✅	✅ (more tests)
Support	❌	✅ Discord
Addons	❌	✅ Chaos, Firewall, Hosting, Latency, OpenID, Razor, Swagger, LetsEncrypt, Templates, Serilog, Log4net

Release Candidate

State of the Rewrite

Here we are, the last step : the Release Candidate.

I spent a few days thinking about the kind of logging system I wanted for SimpleW. I follow the rule n°1 that guides me : simplicity.

The logger is basically a simple emit() with a few methods on top. It supports sinks, and you can bridge your own logger on it. There are even two packages available for the most widely used .NET loggers : serilog and log4net.

There is a new SimpleWSServer.ConfigureClientIPResolver() methods that allow you to configure where the real client IP address comes from. It replaced the one in the Firewall package (so this is a breaking change for the SimpleW.Service.Firewall).

Finally, there are a few minor fixes in the HttpSession and a new Bag feature that allows data to be shared between middlewares.

The documentation is up to date !

feature / comparison

Feature / Aspect	SimpleW v16 (old)	SimpleW v26 (new)
NET runtime	NET8	NET8 but should consider NET9/NET10 for better perfs and RAM usage under heady load (e.g: NET8 400Mo, NET9 100Mo, NET10 70Mo)
Core architecture	⚠️ (tied to NetCoreServer)	✅ from scratch (custom, simple, clean)
Code readability	⚠️	✅
Overall design philosophy	⚠️ wrapper	✅ minimal, custom, fast
Long-term maintainability	⚠️ harder	✅ much easier
Performance	✅ (very high)	✅ (very high)
Middleware	❌	✅
Modules	❌	✅
Extensibility	⚠️ (callback, subclass)	✅ middleware, module, callback, subclass
Response Builder	✅(status, contentType, headers, body, cookies)	✅ (status, contentType, contentLength, headers, body, cookies, compression)
Handler (Expression Tree)	✅ sync ❌async	✅ sync ✅ async + RequestAborted
Routing	✅ (minimal, attribute, querystring, regexp, path, wildcard)	✅ (minimal, attribute, querystring, path, wildcard)
Minimal API	✅	✅
Controllers	✅	✅
SSL / HTTPS	✅ (SslContext)	✅ (SslContext, mutual authentication)
WebSocket	✅ (full broadcast)	✅ (smart broadcast using "rooms")
Server-Sent Events (SSE)	✅	✅ (smart broadcast using "rooms")
Basic Auth	❌	✅
JWT auth	✅	✅
Unix socket	✅	✅
Static files	✅ (Cache, FileWatcher)	✅ (Cache, FileWatcher, Last-Modified, Etag)
Cross-Origin Resource Sharing (CORS)	✅	✅
Body parsing (JSON)	✅	✅
Body parsing (form-urlencoded)	✅	✅
Body parsing (multipart/form-data)	✅	✅
Bag	❌	✅ (share data between middleware)
WebUser / Identity	✅	✅
Custom JSON engine	✅	✅
HTTP pipelining	❌	✅
Idle Timeout	❌	✅
Request Protection	❌	✅(malformed)
Observability	✅ (traces) & global to all processes	✅ (traces, metrics, enrich) per SimpleWServer instance
Logging	❌	✅
Documentation	✅	✅ simplew.net
Tests	✅	✅ (more tests)
Support	❌	✅ Discord
Addons	❌	✅ Chaos, Firewall, Hosting, Latency, OpenID, Razor, Swagger, LetsEncrypt, Templates, Serilog, Log4net

Consolidating Beta

State of the Rewrite

I’m consolidating and polishing the entire codebase :

• No API changes, things are boring stable now.
• I’m focusing on addon development : three new ones have been added: LetsEncrypt, OpenID, and Templates.
• I’m hardening the HttpRequestParser against malformed requests and well-known attack patterns.
• I also want to make migration from ASP.NET Core easier by adding helpers and utilities (for example, a Bag to pass data across middleware).
• Fixed a few minor bugs in HttpSession.
• Added new methods and events to the SimpleWServer class.
• Improved documentation

Feature / Aspect	SimpleW v16 (current)	SimpleW v26 (in progress)
NET runtime	NET8	NET8 but should consider NET9/NET10 for better perfs and RAM usage under heady load (e.g: NET8 400Mo, NET9 100Mo, NET10 70Mo)
Core architecture	⚠️ (tied to NetCoreServer)	✅ from scratch (custom, simple, clean)
Code readability	⚠️	✅
Overall design philosophy	⚠️ wrapper	✅ minimal, custom, fast
Long-term maintainability	⚠️ harder	✅ much easier
Performance	✅ (very high)	✅ (very high)
Middleware	❌	✅
Modules	❌	✅
Extensibility	⚠️ (callback, subclass)	✅ midlleware, module, callback, subclass
Response Builder	✅(status, contentType, headers, body, cookies)	✅ (status, contentType, contentLength, headers, body, cookies, compression)
Handler (Expression Tree)	✅ sync ❌async	✅ sync ✅ async + RequestAborted
Routing	✅ (minimal, attribute, querystring, regexp, path, wildcard)	✅ (minimal, attribute, querystring, path, wildcard)
Minimal API	✅	✅
Controllers	✅	✅
SSL / HTTPS	✅ (SslContext)	✅ (SslContext)
WebSocket	✅(full broadcast)	✅ (smart broadcast using "rooms")
Server-Sent Events (SSE)	✅	✅ (smart broadcast using "rooms")
Basic Auth	❌	✅
JWT auth	✅	✅
Unix socket	✅	✅
Static files	✅ (Cache, FileWatcher)	✅ (Cache, FileWatcher, Last-Modified, Etag)
Cross-Origin Resource Sharing (CORS)	✅	✅
Body parsing (JSON)	✅	✅
Body parsing (form-urlencoded)	✅	✅
Body parsing (multipart/form-data)	✅	✅
WebUser / Identity	✅	✅
Custom JSON engine	✅	✅
HTTP pipelining	❌	✅
Idle Timeout	❌	✅
Request Protection	❌	✅(malformed)
Observability	✅ (traces) & global to all processes	✅ (traces, metrics, enrich) per SimpleWServer instance
Documentation	✅	✅ simplew.net
Tests	✅	✅ (more tests)
Support	❌	✅ Discord
Add-Ons	❌	✅ Chaos, Firewall, Hosting, Latency, LetsEncrypt, OpenID, Razor, Swagger, Templates