goauthentik / goauthentik/authentik
Disable HTTP Compression
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
**Is your feature request related to a problem? Please describe.**
Authentik currently uses HTTP compression, which is a security issue as HTTP compression is vulnerable to the BREACH attack. Since Authentik is a security critical application, it should have HTTP compression disabled.
**Describe the solution you'd like**
Disable HTTP Compression in Authentik
Contributor guide
Research direction
Start by locating Authentik's HTTP response or server configuration responsible for compression; the issue does not name a file, test, or entry point. Verify the relevant responses no longer advertise compression, and run the closest existing HTTP or integration tests to confirm behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100