What Are gRPC & gRPC Web

Basics of gRPC & gRPC-Web

Amin Nasiri
3 min readSep 1, 2023

I tried to make this article simple and short because I made this one as a prerequisite for my article “Hacking into gRPC-Web”.

What is gRPC?

In short, gRPC is a high-performance, open-source universal RPC framework that was initially created by Google. From grpc.io reference:

gRPC is a modern open-source high-performance Remote Procedure Call (RPC) framework that can run in any environment. It can efficiently connect services in and across data centers with pluggable support for load balancing, tracing, health checking, and authentication. It is also applicable in last mile of distributed computing to connect devices, mobile applications, and browsers to back-end services.

Because there are good resources for describing gRPC, I recommend watching this YouTube Video which explains gRPC and a quick explanation of gRPC-Web and why gRPC is getting used more. Then continue reading this article:

What is gRPC-Web?

gRPC is based on HTTP/2 protocol because H2 presents some performance-related features like header compression, flow control, multiplexing, etc. Currently, it is impossible to implement the HTTP/2 gRPC spec in the browser, because there is no browser API with enough fine-grained control over the requests and there is no way to force the use of HTTP/2, and even if there was, raw HTTP/2 frames are inaccessible in the browsers. So, now is the time that gRPC-Web comes into the scene. gRPC-Web is developed to bridge this gap, and it is developed to make a way to use gRPC in web applications and browsers. There are two important parts in gRPC-web:

1. gRPC-Web JavaScript Implementation in Browsers

A library that implements gRPC-Web in the browser.

2. gRPC-Web Proxy

The proxy transforms requests from gRPC-Web to gRPC native format. There are different proxies for gRPC-Web, one is Envoy proxy.
Here is a good example for examining the design of gRPC-Web:

gRPC-Web Design

And here are two different types of implementing gRPC in web applications:

at the right, we see the web applications present services in REST API Style, and then at the back-end it handles the gRPC requests itself. But at the left part, there is gRPC-Web style which the browser sends kind of direct gRPC requests but in a different style to the proxy, and the proxy transforms the request to gRPC protocol back-end services(in HTTP/2) and also does this flow for responses in reverse.

gRPC-Web and Rest to gRPC Design
https://grpc.io/blog/grpc-web-ga/

For more information, you can search more about gRPC-Web, because the article is about hacking gRPC-Web and there are good resources to explain basics better than me.

What Are .proto File and Protocol Buffers?

A .proto file, also known as a Protocol Buffers file, is a text file used to define the structure of data that can be serialized (converted into a compact binary format) and deserialized (converted back into its original data structure) using Google's Protocol Buffers (protobufs) technology. Protocol Buffers is a language-agnostic serialization framework developed by Google, often used for communication between systems and for data storage.

Example of .proto file:

Example .Proto File
https://protobuf.dev/programming-guides/proto3/

Protocol Buffer Compiler makes this .proto file to desired programming languages gRPC Stubs, which are then used in coding gRPC services and applications. You can learn more about the .proto file and its syntax here.

Link to my article: “Hacking into gRPC-Web”.

--

--

Amin Nasiri

Mohammadamin Nasiri: Application Security Engineer | Bug Bounty Hunter [Github: nxenon]