danielgtaylor / danielgtaylor/huma

If fiber's StreamRequestBody is enabled and request body compression is enabled, the request will fail.

Open
#1,111 1 comment 1 reaction 0 assignees View on GitHub
bug
Dominant language
Go
Stars
4.4k
Forks
285
Avg merge
40m
Merged PRs (30d)
1

Description

## background

The request body is compressed using `Content-Encoding: br`.

- Disable StreamRequestBody: Request works normally
- Enabling StreamRequestBody: Request failed

## analyze

The server-side decompression layer was originally handled by fiber itself: fiber v3's DefaultReq.Body() ([req.go:150](https://github.com/gofiber/fiber/v3/blob/v3.3.0/req.go#L150)) would call BodyUnbrotliWithLimit to automatically decompress when it reads Content-Encoding. However, note the huma fiber v3 adapter [humafiber.go:106-113](https://github.com/danielgtaylor/huma/blob/v2.39.0/adapters/humafiber/humafiber.go#L106-L113):

```go
func (c *fiberWrapper) BodyReader() io.Reader {
if orig.App().Server().StreamRequestBody {
// Streaming is enabled, so send the reader.
return orig.Request().BodyStream() // ← raw compressed stream, bypassing Body() decompression.
}
return bytes.NewReader(orig.Body()) // ← fiber Body() will automatically decompress
}
```

After enabling StreamRequestBody, Huma reads the raw stream directly from Request().BodyStream(), bypassing the Content-Encoding decompression provided by fiber Body(); however, the Huma core does not handle HTTP layer Content-Encoding (it only recognizes base64 in the schema). Therefore, the Brotli stream enters the JSON parser as is → invalid character '\x1b' (0x1b is the first byte of the Brotli stream) → 400.

In other words, this is a real compatibility gap: huma (fiber v3) + StreamRequestBody will lose the decompression of the request body (Content-Encoding). It didn't cause this issue before because when BodyLimit was enabled or streams were not running, huma would decompress the request body via the orig.Body() branch.

This appears to be a regression of issue #1055.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with adapters/humafiber/humafiber.go around lines 106-113 and compare it with fiber v3's req.go around line 150. Reproduce a Brotli-compressed request with StreamRequestBody enabled, then verify that the request reaches Huma's JSON parser successfully and still behaves correctly without streaming.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.