Webserver

comes with a builtin webserver based on libmicrohttpd which provides several services accessible through HTTP.

Enabling the webserver
The webserver is disabled by default and has to be manually enabled by the user. This can be done in Settings → Services → Webserver → Allow control of via HTTP. The settings allow to specify a custom port number and an optional username and password for HTTP's Basic Access Authentication. Furthermore a Web interface can be chosen which will be used when accessing the webserver without any specific path.

Hints
Allow EncodedSlashes is necessary to have webpages work properly.
 * If the webserver fails to start make sure you use a port that is not blocked by your firewall and is not used by any other process running on the same machine. If there is another webserver like Apache running on the same machine it is very likely that port 80 (HTTP default port) is already used.
 * On Linux ports below 1024 require super-user privileges and are therefore not available to.
 * For use in a virtual hosts environment in Apache, the following directives can be used:

Services
The webserver offers several services which can be accessed based on the path specified in the HTTP request. The webserver is accessible through HTTP using the following URL http:// : /

Webinterface
When no path is specified or the specified path does not correspond to any of the available services the webserver will try to locate the requested path/file in the configured Web interface.

Webinterface addons /addons
Requesting the /addons path will show a HTML page with a list of all installed and available webinterface addons. By appending the identifier of one of the webinterface addons to the /addons path it is possible to access all the available webinterfaces without configuring them in the settings.

Image cache /image
The image cache service provides access to cached images (thumbnails, fanart, ...) of media items. The image URL (image://) returned by JSON-RPC has to be URL encoded before appending it: http:// : /image/

JSON-RPC API /jsonrpc
The JSON-RPC API service provides access to the JSON-RPC API using HTTP POST or GET. Requesting the /jsonrpc path without any additional POST or GET data will return the full documentation of the JSON-RPC API in JSON schema format.

Virtual File System /vfs
The Virtual File System (VFS) service provides access to files accessible to through its VFS. The VFS path has to be URL encoded before appending it: http:// : /vfs/

As of XBMC v12 Frodo, in an effort to make the Virtual File System service more secure (in Eden and before it allowed access to literally any file on the local hard disc and on network shares accessible to ) the access has been limited to files within directories that have been specified by the user as sources (video, music, files, programs) in.