What is response compression, and should the app do it?
Quick Answer
Response compression (gzip/Brotli) shrinks text responses (JSON, HTML, CSS) based on the client's Accept-Encoding header. ASP.NET Core has AddResponseCompression() + UseResponseCompression(), but it's usually better to let the reverse proxy / CDN (IIS, Nginx, CloudFront) do it — offloading CPU from the app.
Response compression uses gzip or Brotli to shrink text payloads like JSON before sending them, based on what the client says it accepts. ASP.NET Core has middleware for it, but my default is to let the reverse proxy or CDN handle compression, because that keeps the CPU cost off the app server. I only turn it on in the app when there's nothing in front of it doing the job — like Kestrel running at the edge in a container. And you skip it for already-compressed content like images.
- Enable in-app when there's no proxy doing it (e.g. Kestrel edge, some container setups).
- Brotli gives better ratios than gzip for text; both are supported.
- Don't compress already-compressed content (images, video, zip) — wasted CPU.
- Security: compressing responses that mix secrets with attacker-controlled input over HTTPS has a (largely theoretical for APIs) BREACH-style risk — relevant mostly for HTML with CSRF tokens, not typical JSON APIs.