Skip to content

/go

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http: Content-Type sniffing interacts poorly with compression #31753

Open
andybalholm opened this issue Apr 30, 2019 · 2 comments

Comments

Assignees
No one assigned
Labels
NeedsInvestigation
Projects
None yet
Milestone
  Go1.13
3 participants
@andybalholm @firelizzard18 @bradfitz
@andybalholm
Copy link

commented Apr 30, 2019 •
edited

What version of Go are you using (go version)?

$ go version
go version go1.12.4 darwin/amd64

What did you do?

func serve(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Encoding", "gzip")
	gzw := gzip.NewWriter(w)
	defer gzw.Close()
	io.WriteString(gzw, `<!doctype html><p>Hello</p>`)
}

What did you expect to see?

Content-Type header of "text/html", or none at all.

What did you see instead?

Content-Type header of "application/x-gzip".

Since the content being written to the ResponseWriter is compressed with gzip, the Content-Type is being detected as application/x-gzip.

Content-Type sniffing should be disabled when there is a Content-Encoding header.

@bradfitz bradfitz added this to the Go1.13 milestone May 1, 2019

@bradfitz bradfitz added the NeedsInvestigation label May 1, 2019

@firelizzard18

This comment has been minimized.

Sign in to view
Copy link

commented May 1, 2019

I ran into the same issue. Chrome is pretty smart about ignoring the bad content type and correctly interpreting files. Firefox is not. Firefox will attempt to interpret the raw GZIP bytes as JavaScript (and fail badly).
@bradfitz

This comment has been minimized.

Sign in to view
Copy link
Member

commented May 1, 2019

@tombergan, thoughts?
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.