Compression and Archives: GZip, Brotli, ZipArchive's Async APIs and Zip Slip
Sending a large zip to a user needs no file or MemoryStream: ZipArchive's Create mode writes entries straight to the response body, but because .NET 10's async ZIP APIs still write the end of each entry synchronously, Kestrel needs an explicit allowance. We measure GZip, ZLib, Deflate and Brotli at each level, compare zip with tar.gz and safely extract an uploaded zip against Zip Slip and zip bombs.
14 Nov 2026
·
15 min
·
2
