Add Server::set_compress() to turn off handler response compression

A server built with compression support compressed every handler
response the client accepted, with no way to turn it off. Over HTTPS
the length of a compressed response can give away a secret in it when
the same response also carries text an attacker chooses (BREACH).
set_compress(false) sends handler responses, buffered or streamed, as
they are; compression stays on by default, and static file compression
keeps its own setting. The README and the cookbook describe the switch
and when to use it.
This commit is contained in:
yhirose committed 2026-10-21 23:34:48 -04:00
1 parent 3b8b9cf9d5
commit fc37d3eae1
5 files changed
+67 -1

No files matched your search

+10 -1
View File
@@ -2357,6 +2357,8 @@ public:
Server &set_payload_max_length(size_t length);
Server &set_compress(bool on);
Server &set_static_file_compression(bool on);
Server &set_static_file_compression_min_length(size_t length);
Server &set_static_file_compression_max_length(size_t length);
@@ -2431,6 +2433,7 @@ protected:
time_t idle_interval_sec_ = CPPHTTPLIB_IDLE_INTERVAL_SECOND;
time_t idle_interval_usec_ = CPPHTTPLIB_IDLE_INTERVAL_USECOND;
size_t payload_max_length_ = CPPHTTPLIB_PAYLOAD_MAX_LENGTH;
bool compress_ = true;
bool static_file_compression_ = false;
size_t static_file_compression_min_length_ =
CPPHTTPLIB_STATIC_FILE_COMPRESSION_MIN_LENGTH;
@@ -13854,6 +13857,11 @@ inline Server &Server::set_payload_max_length(size_t length) {
return *this;
}
inline Server &Server::set_compress(bool on) {
compress_ = on;
return *this;
}
inline Server &Server::set_static_file_compression(bool on) {
static_file_compression_ = on;
return *this;
@@ -14882,7 +14890,8 @@ inline void Server::apply_ranges(const Request &req, Response &res,
"multipart/byteranges; boundary=" + boundary);
}
auto type = detail::encoding_type(req, res);
auto type =
compress_ ? detail::encoding_type(req, res) : detail::EncodingType::None;
if (res.body.empty()) {
if (res.content_length_ > 0 && req.ranges.size() == 1 &&