HTTP Compression Algorithms

networking

HTTP compression reduces the size of data transferred between a web server and a client, improving loading speed and reducing bandwidth usage. These algorithms are lossless.

Common Algorithms

Feature	Brotli	Gzip	Zstandard
Encoding	br	gzip	zstd
Compression ratio	High	Moderate	High
Compression speed	Slower at high levels	Fast	Very fast
Decompression	Fast	Fast	Very fast
Common use	Static web assets	General web traffic	Modern web traffic

How It Works

1. Browser sends supported algorithms using Accept-Encoding.
2. Server selects a supported compression algorithm.
3. Server compresses the response.
4. Browser decompresses the data.

Example HTTP headers:

Accept-Encoding: br, gzip, zstd
Content-Encoding: br

flowchart TD
    A["🌐 Browser / Client"] -->|"HTTP Request: Accept-Encoding: br, gzip, zstd"| B["🖥️ Web Server"]

    B --> C{"Select Compression Algorithm"}

    C --> D["Brotli (br)"]
    C --> E["Gzip (gzip)"]
    C --> F["Zstandard (zstd)"]
    C --> G["No Compression"]

    D --> H["High compression ratio"]
    E --> I["Fast, widely compatible"]
    F --> J["Fast with high compression"]

    H --> K["Compressed HTTP Response"]
    I --> K
    J --> K
    G --> L["Uncompressed HTTP Response"]

    K --> M["Content-Encoding: br / gzip / zstd"]
    M --> N["Browser Decompresses Data"]
    L --> O["Browser Uses Data Directly"]
    N --> P["Original HTML / CSS / JS"]
    O --> P

    style A fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style B fill:#dbeafe,stroke:#2563eb,color:#1e40af
    style D fill:#dcfce7,stroke:#16a34a,color:#166534
    style E fill:#fef3c7,stroke:#d97706,color:#92400e
    style F fill:#f3e8ff,stroke:#9333ea,color:#6b21a8
    style P fill:#dcfce7,stroke:#16a34a,color:#166534

How to Identify Compression

Using curl:

curl -sS -D - -o /dev/null \
  --compressed https://example.com

Check Content-Encoding:

• br → Brotli
• gzip → Gzip
• zstd → Zstandard
• Missing header → Usually no HTTP content compression

Using Browser: F12 → Network → Select Request → Headers → Content-Encoding

Security Considerations

• Decompression libraries may contain vulnerabilities.
• Malicious compressed payloads can exploit vulnerable decoders.
• Possible impacts include Denial of Service, Memory Corruption, and Remote Code Execution.
• Keep compression libraries and application runtimes updated.

Related: HTTP2Shell

Using Brotli does not automatically mean a website is vulnerable. Vulnerability depends on the decoder implementation, version, and exposure to untrusted data.

Key Takeaway

• Brotli: Excellent compression for static web assets.
• Gzip: Widely supported and reliable.
• Zstandard: High-performance modern compression.

References

• Google Brotli
• RFC 1952 — Gzip
• RFC 8878 — Zstandard
• MDN — Accept-Encoding