goauthentik / goauthentik/authentik

Disable HTTP Compression

Open
#17,681 1 comment 0 reactions 0 assignees View on GitHub
enhancement enhancement/under_consideration
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

**Is your feature request related to a problem? Please describe.**
Authentik currently uses HTTP compression, which is a security issue as HTTP compression is vulnerable to the BREACH attack. Since Authentik is a security critical application, it should have HTTP compression disabled.

**Describe the solution you'd like**
Disable HTTP Compression in Authentik

Contributor guide

Open the contributing guide

Research direction

Start by locating Authentik's HTTP response or server configuration responsible for compression; the issue does not name a file, test, or entry point. Verify the relevant responses no longer advertise compression, and run the closest existing HTTP or integration tests to confirm behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.