ory/hydra · error

err.Error()

Error message

err.Error()

What it means

In defaultCompressionErrorHandler, the raw error text is written as a 400 Bad Request when a request claiming gzip Content-Encoding fails to decompress while being wrapped by the CompressionRequestReader. The client sent a malformed or corrupt gzip body; the error string (from compress/gzip or the reader) names the concrete decoding failure.

Source

Thrown at oryx/httpx/gzip_server.go:19

// Copyright © 2023 Ory Corp
// SPDX-License-Identifier: Apache-2.0

package httpx

import (
	"compress/gzip"
	"fmt"
	"io"
	"net/http"
	"strings"
)

type CompressionRequestReader struct {
	ErrHandler func(w http.ResponseWriter, r *http.Request, err error)
}

func defaultCompressionErrorHandler(w http.ResponseWriter, r *http.Request, err error) {
	http.Error(w, err.Error(), http.StatusBadRequest)
}

func NewCompressionRequestReader(eh func(w http.ResponseWriter, r *http.Request, err error)) *CompressionRequestReader {
	if eh == nil {
		eh = defaultCompressionErrorHandler
	}

	return &CompressionRequestReader{
		ErrHandler: eh,
	}
}

func (c *CompressionRequestReader) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
	for _, enc := range strings.Split(r.Header.Get("Content-Encoding"), ",") {
		switch enc = strings.TrimSpace(enc); enc {
		case "gzip":
			reader, err := gzip.NewReader(r.Body)
			if err != nil {

View on GitHub (pinned to 4174065ffb)

Solutions

1. Send the body uncompressed or with correctly encoded gzip Content-Encoding
2. Provide a custom error handler via NewCompressionRequestReader to control the response format
3. Log decode failures to detect broken clients or malicious payload probing

When it happens

Trigger: Thrown at oryx/httpx/gzip_server.go:19 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/4013736ac49f4ea2. Report an issue: GitHub.