Index: Makefile
==================================================================
--- Makefile
+++ Makefile
@@ -1,7 +1,9 @@
 default: althttpd althttpsd 
 VERSION_NUMBER = 2.0
+CC=cc
+CFLAGS=-Os -Wall -Wextra
 
 manifest:
 	@if which fossil > /dev/null; then \
 		fossil update --nosync current; \
 	else \
@@ -19,22 +21,21 @@
 		echo '$(VERSION_NUMBER)' "[$$hash] [$$time]\""; \
 	} > $@
 
 althttpd:	althttpd.c version
 	@flags="`cat version`"; set -x; \
-	cc "-D$$flags" -Os -Wall -Wextra -o althttpd althttpd.c
+	$(CC) $(CFLAGS) "-D$$flags" -o althttpd althttpd.c
 
 althttpsd:	althttpd.c version
 	@flags="`cat version`"; set -x; \
-	cc "-D$$flags" -Os -Wall -Wextra -fPIC -o althttpsd -DENABLE_TLS althttpd.c -lssl -lcrypto
+	$(CC) $(CFLAGS) "-D$$flags" -fPIC -o althttpsd -DENABLE_TLS althttpd.c -lssl -lcrypto
 
 static-althttpd:	althttpd.c version
 	@flags="`cat version`"; set -x; \
-	cc "-D$$flags" -Os -Wall -Wextra -static -o althttpd althttpd.c
+	$(CC) $(CFLAGS) "-D$$flags" -static -o althttpd althttpd.c
 
 static-althttpsd:	althttpd.c version
 	@flags="`cat version`"; set -x; \
-	cc "-D$$flags" -Os -Wall -Wextra -static -fPIC -o althttpsd -DENABLE_TLS althttpd.c -lssl -lcrypto -lpthread -ldl
+	$(CC) $(CFLAGS) "-D$$flags" -static -fPIC -o althttpsd -DENABLE_TLS althttpd.c -lssl -lcrypto -lpthread -ldl
 
 clean:	
 	rm -f althttpd althttpsd version
-

Index: althttpd.c
==================================================================
--- althttpd.c
+++ althttpd.c
@@ -170,10 +170,16 @@
 **                   HTTP connection.  Default 30 (build option:
 **                   -DMAX_CPU=integer). 0 means no limit.
 **
 **  --debug BOOLEAN  Disables input timeouts.  This is useful for debugging
 **                   when inputs are being typed in manually.
+**
+**  --enable-sab     Add new lines to the HTTP reply header that are
+**                   prerequisites for SharedArrayBuffer.  These are the lines:
+**                     Cross-Origin-Embedder-Policy: require-corp
+**                     Cross-Origin-Opener-Policy: same-origin
+**        
 **
 ** Additional command-line options available when compiling with ENABLE_TLS:
 **
 **  --cert FILE      The TLS certificate, the "fullchain.pem" file
 **
@@ -424,10 +430,12 @@
 static char *default_path = "/bin:/usr/bin";  /* Default PATH variable */
 static char *zScgi = 0;          /* Value of the SCGI env variable */
 static int rangeStart = 0;       /* Start of a Range: request */
 static int rangeEnd = 0;         /* End of a Range: request */
 static int maxCpu = MAX_CPU;     /* Maximum CPU time per process */
+static int enableSAB = 0;        /* Add reply header to enable
+                                 ** SharedArrayBuffer */
 
 /* Forward reference */
 static void Malfunction(int errNo, const char *zFormat, ...);
 
 
@@ -697,10 +705,11 @@
     if( zRealScript==0 ) zRealScript = "";
     if( zRemoteAddr==0 ) zRemoteAddr = "";
     if( zHttpHost==0 ) zHttpHost = "";
     if( zReferer==0 ) zReferer = "";
     if( zAgent==0 ) zAgent = "";
+    if( zQuerySuffix==0 ) zQuerySuffix = "";
     gettimeofday(&now, 0);
     pTm = localtime(&now.tv_sec);
     strftime(zDate, sizeof(zDate), "%Y-%m-%d %H:%M:%S", pTm);
     sz = strftime(zExpLogFile, sizeof(zExpLogFile), zLogFile, pTm);
     if( sz>0 && sz<sizeof(zExpLogFile)-2 ){
@@ -737,13 +746,14 @@
       ** (15) Remote user
       ** (16) Bytes of URL that correspond to the SCRIPT_NAME
       ** (17) Line number in source file
       */
       fprintf(log,
-        "%s,%s,\"%s://%s%s\",\"%s\","
+        "%s,%s,\"%s://%s%s%s\",\"%s\","
            "%s,%d,%d,%lld,%lld,%lld,%lld,%lld,%d,\"%s\",\"%s\",%d,%d\n",
         zDate, zRemoteAddr, zHttpScheme, Escape(zHttpHost), Escape(zScript),
+        Escape(zQuerySuffix),
         Escape(zReferer), zReplyStatus, nIn, nOut,
         tvms(&self.ru_utime) - tvms(&priorSelf.ru_utime),
         tvms(&self.ru_stime) - tvms(&priorSelf.ru_stime),
         tvms(&children.ru_utime) - tvms(&priorChild.ru_utime),
         tvms(&children.ru_stime) - tvms(&priorChild.ru_stime),
@@ -2156,10 +2166,16 @@
   }else{
     StartResponse("200 OK");
     rangeStart = 0;
   }
   nOut += DateTag("Last-Modified", pStat->st_mtime);
+  if( enableSAB ){
+    /* The following two HTTP reply headers are required if javascript
+    ** is to make use of SharedArrayBuffer */
+    nOut += althttpd_printf("Cross-Origin-Opener-Policy: same-origin\r\n");
+    nOut += althttpd_printf("Cross-Origin-Embedder-Policy: require-corp\r\n");
+  }
   nOut += althttpd_printf("Cache-Control: max-age=%d\r\n", mxAge);
   nOut += althttpd_printf("ETag: \"%s\"\r\n", zETag);
   nOut += althttpd_printf("Content-type: %s%s\r\n",zContentType,
                           bAddCharset ? "; charset=utf-8" : "");
   if( zEncoding ){
@@ -3416,10 +3432,13 @@
       maxCpu = atoi(zArg);
     }else
     if( strcmp(z,"-loopback")==0 ){
       bLocalhost = 1;
       nTerm = 1;
+    }else
+    if( strcmp(z,"-enable-sab")==0 ){
+      enableSAB = 1;
     }else
     if( strcmp(z,"-page")==0 ){
       zPage = zArg;
       bLocalhost = 1;
       if( mnPort==0 ){