6.0 KiB
| title | author | description | monikerRange | ms.author | ms.date | uid |
|---|---|---|---|---|---|---|
| Request decompression in ASP.NET Core | david-acker | Learn how to use the request decompression middleware in ASP.NET Core | >= aspnetcore-7.0 | riande | 8/17/2022 | fundamentals/middleware/request-decompression |
Request decompression in ASP.NET Core
By David Acker
Request decompression middleware:
- Enables API endpoints to accept requests with compressed content.
- Uses the
Content-EncodingHTTP header to automatically identify and decompress requests which contain compressed content. - Eliminates the need to write code to handle compressed requests.
When the Content-Encoding header value on a request matches one of the available decompression providers, the middleware:
- Uses the matching provider to wrap the xref:Microsoft.AspNetCore.Http.HttpRequest.Body?displayProperty=nameWithType in an appropriate decompression stream.
- Removes the
Content-Encodingheader, indicating that the request body is no longer compressed.
Requests that don't include a Content-Encoding header are ignored by the request decompression middleware.
Decompression:
- Occurs when the body of the request is being read. That is, decompression occurs at the endpoint on model binding. The request body is not decompressed eagerly.
- When attempting to read the decompressed request body, if the compressed data is invalid for the specified
Content-Encoding, an exception is thrown.
If the middleware encounters a request with compressed content but is unable to decompress it, the request is passed to the next delegate in the pipeline. For example, a request with an unsupported Content-Encoding header value or multiple Content-Encoding header values, is passed to the next delegate in the pipeline. For example, Brotli can throw System.InvalidOperationException: Decoder ran into invalid data, Deflate and GZip can throw System.IO.InvalidDataException: The archive entry was compressed using an unsupported compression method.
Configuration
The following code shows how to enable request decompression for the default Content-Encoding types:
Default decompression providers
The Content-Encoding header values that the request decompression middleware supports by default are listed in the following table:
Content-Encoding header values |
Description |
|---|---|
br |
Brotli compressed data format |
deflate |
DEFLATE compressed data format |
gzip |
Gzip file format |
Custom decompression providers
Support for custom encodings can be added by creating custom decompression provider classes that implement xref:Microsoft.AspNetCore.RequestDecompression.IDecompressionProvider:
Custom decompression providers are registered with xref:Microsoft.AspNetCore.RequestDecompression.RequestDecompressionOptions along with their corresponding Content-Encoding header values:
Request size limits
In order to guard against zip bombs or decompression bombs:
- The maximum size of the decompressed request body is limited to the request body size limit enforced by the endpoint or server.
- If the number of bytes read from the decompressed request body stream exceeds the limit, an InvalidOperationException is thrown to prevent additional bytes from being read from the stream.
In order of precedence, the maximum request size for an endpoint is set by:
- xref:Microsoft.AspNetCore.Http.Metadata.IRequestSizeLimitMetadata.MaxRequestBodySize?displayProperty=nameWithType, such as xref:Microsoft.AspNetCore.Mvc.RequestSizeLimitAttribute or xref:Microsoft.AspNetCore.Mvc.DisableRequestSizeLimitAttribute for MVC endpoints.
- The global server size limit xref:Microsoft.AspNetCore.Http.Features.IHttpMaxRequestBodySizeFeature.MaxRequestBodySize?displayProperty=nameWithType.
MaxRequestBodySizecan be overridden per request with xref:Microsoft.AspNetCore.Http.Features.IHttpMaxRequestBodySizeFeature.MaxRequestBodySize?displayProperty=nameWithType, but defaults to the limit configured for the web server implementation.
[!WARNING] Disabling the request body size limit poses a security risk in regards to uncontrolled resource consumption, particularly if the request body is being buffered. Ensure that safeguards are in place to mitigate the risk of denial-of-service (DoS) attacks.