httpbin icon indicating copy to clipboard operation
httpbin copied to clipboard

feat: Add optional feature to decompress encoded request body

Open raphaeleidus opened this issue 4 years ago • 1 comments

This PR addresses #577 Because of Zip Bomb attacks this feature is disabled by default and should only be turned on when running httpbin locally as follows

docker run --env UNSAFE_BODY_DECOMPRESSION=1 -p 80:80 kennethreitz/httpbin

There are valid use cases where a server is going to receive payloads only from a trusted source that will be compressed and this can help testing around those.

raphaeleidus avatar Jul 08 '21 00:07 raphaeleidus

Good idea

Starmania avatar Sep 20 '22 15:09 Starmania