Flagsmith / Flagsmith/flagsmith
Ensure all Flagsmith clients negotiate gzip when calling the API
- Dominant language
- Python
- Stars
- 6.6k
- Forks
- 567
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 121
Description
## Context
While benchmarking our edge-proxy against `edge.api.flagsmith.com`, we found that `GET /api/v1/environment-document/` returns **HTTP 502 Bad Gateway** when the response would exceed ~1 MB uncompressed, but succeeds when the client negotiates gzip.
## Reproduction
Project populated with ~50 features × 15 segments × 750 overrides × 1 KB values → env-doc ~1.04 MB uncompressed.
**Fails (502):**
```bash
curl -v -H "X-Environment-Key: " \
"https://edge.api.flagsmith.com/api/v1/environment-document/"
```
Response is from the AWS ALB, not Flagsmith's app:
```
HTTP/2 502
server: awselb/2.0
content-length: 122
```
**Succeeds (200) with gzip:**
```bash
curl -v --compressed -H "X-Environment-Key: " \
"https://edge.api.flagsmith.com/api/v1/environment-document/"
```
```
HTTP/2 200
content-encoding: gzip
content-length: 38732 # (decompresses to 1,043,074 bytes)
aws-lambda-region: ap-south-1
```
## Root cause
Flagsmith's edge API runs on AWS ALB → Lambda. The ALB↔Lambda integration has a ~1 MB response payload limit. With gzip, the response fits; without, the ALB returns a canned 502 before Flagsmith's app even gets to respond.
## The ask
Ensure **every official Flagsmith client** sends `Accept-Encoding: gzip` and transparently decompresses. Without this, any customer with an env-doc >1 MB (larger projects) hits failures depending on which client they use.
Our Rust edge-proxy is already correct:
```rust
let client = Client::builder().gzip(true).build()
```
Audit needed across SDKs (Python, Node/JS, Java, Go, Rust, Ruby, .NET, PHP, Elixir, iOS/Android) and the Python edge-proxy. Docs should flag this for anyone writing custom integrations.
## Workaround today
If you see intermittent 502s from `/environment-document/`, confirm your HTTP client is sending `Accept-Encoding: gzip`. It's on by default in most high-level libraries (Python `requests`, JS `fetch`, `reqwest` with `.gzip(true)`) but not always in low-level ones or curl.
Contributor guide
Assessment
This issue has not been assessed yet.