danielgtaylor / danielgtaylor/huma
If fiber's StreamRequestBody is enabled and request body compression is enabled, the request will fail.
- Dominant language
- Go
- Stars
- 4.4k
- Forks
- 285
- Avg merge
- 40m
- Merged PRs (30d)
- 1
Description
## background
The request body is compressed using `Content-Encoding: br`.
- Disable StreamRequestBody: Request works normally
- Enabling StreamRequestBody: Request failed
## analyze
The server-side decompression layer was originally handled by fiber itself: fiber v3's DefaultReq.Body() ([req.go:150](https://github.com/gofiber/fiber/v3/blob/v3.3.0/req.go#L150)) would call BodyUnbrotliWithLimit to automatically decompress when it reads Content-Encoding. However, note the huma fiber v3 adapter [humafiber.go:106-113](https://github.com/danielgtaylor/huma/blob/v2.39.0/adapters/humafiber/humafiber.go#L106-L113):
```go
func (c *fiberWrapper) BodyReader() io.Reader {
if orig.App().Server().StreamRequestBody {
// Streaming is enabled, so send the reader.
return orig.Request().BodyStream() // ← raw compressed stream, bypassing Body() decompression.
}
return bytes.NewReader(orig.Body()) // ← fiber Body() will automatically decompress
}
```
After enabling StreamRequestBody, Huma reads the raw stream directly from Request().BodyStream(), bypassing the Content-Encoding decompression provided by fiber Body(); however, the Huma core does not handle HTTP layer Content-Encoding (it only recognizes base64 in the schema). Therefore, the Brotli stream enters the JSON parser as is → invalid character '\x1b' (0x1b is the first byte of the Brotli stream) → 400.
In other words, this is a real compatibility gap: huma (fiber v3) + StreamRequestBody will lose the decompression of the request body (Content-Encoding). It didn't cause this issue before because when BodyLimit was enabled or streams were not running, huma would decompress the request body via the orig.Body() branch.
This appears to be a regression of issue #1055.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with adapters/humafiber/humafiber.go around lines 106-113 and compare it with fiber v3's req.go around line 150. Reproduce a Brotli-compressed request with StreamRequestBody enabled, then verify that the request reaches Huma's JSON parser successfully and still behaves correctly without streaming.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100