-
Notifications
You must be signed in to change notification settings - Fork 10.4k
Support conditional compression #8239
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Unrelated failure: https://github.com/aspnet/AspNetCore-Internal/issues/1778 @mikaelm12 |
@danroth27 @SteveSandersonMS this should directly improve Blazor |
src/Middleware/ResponseCompression/test/ResponseCompressionMiddlewareTest.cs
Outdated
Show resolved
Hide resolved
c9678ae
to
8f23484
Compare
public enum HttpsCompressionMode | ||
{ | ||
/// <summary> | ||
/// No value has been specified, use the configured defaults. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a "default" default? I'm not sure where I'd look to find the "configured defaults". Is the default hard-coded, or implied somewhere such that we could document it here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I.e. the global value at ResponseCompressionOptions.EnableForHttps
|
||
/// <summary> | ||
/// Opts out of compression over HTTPS. Enabling compression on HTTPS requests for remotely manipulable content | ||
/// may expose security problems. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there any canonical or at least permanent place we could direct folks for more information? Do we have examples of other API ref docs that warn about potential security problems that we can follow form on?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
#6925 @DamianEdwards @glennc @blowdart this allows ResponseCompression's EnableForHttps setting to be overridden per request (opt in or opt out). StaticFiles opts in by default.