发布

RSS 订阅源

2.1.18-5930 bfbcb6feb3

比较
[OPIK-7253] fix: request identity encoding on all react-service auth calls (#7368)

frostbyte_neo 发布于 2026-07-06 16:42:22 +00:00

The auth calls to the react service (auth, auth-session, auth-by-username,
workspace-id) fail with java.util.zip.ZipException: Not in GZIP format
whenever the response is large enough for the upstream to gzip it. The
upstream compression is valid; the failure is client-side double
decompression: with the default jerseyClient.gzipEnabled: true, Dropwizard
wires BOTH Apache HttpClient's automatic content decompression AND Jersey's
GZipDecoder. Apache decompresses the body, the Content-Encoding: gzip header
survives into Jersey, and GZipDecoder gunzips the already-plain stream.

Since the exception is a ProcessingException (not a ClientErrorException),
it escapes the auth filter and surfaces as a 500 to the caller. On the
API-key path this also prevents the credentials from ever being cached, so
affected keys (those with auth responses above the upstream's gzip minimum
entity size) fail on every request.

listEligibleWorkspaces already works around this with acceptEncoding("identity");
apply the same workaround to the remaining five call sites, so the upstream
never compresses and neither decompression layer engages.

Includes a regression test that reproduces the failure with a production-like
client (gzipEnabled: true — the shared test client disables gzip, which is why
existing tests never surfaced this) against a WireMock server that auto-gzips
large responses, exactly like a Dropwizard/Jetty upstream.

Co-authored-by: Claude Fable 5 noreply@anthropic.com
下载附件
- 源代码 (ZIP)
- 源代码 (TAR.GZ)

0 发布 8,340 Git 标签

[OPIK-7253] fix: request identity encoding on all react-service auth calls (#7368)