Response Compression and Payload Size

# ingress-nginx controller ConfigMap: compression for every service behind the ingress.
# ingress-nginx is retired (best-effort maintenance ended March 2026, no more security
# fixes); new clusters should use a maintained Gateway API implementation or the cloud
# load balancer or CDN, which expose the same settings.
apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
data:
  use-gzip: "true"
  gzip-level: "5"
  gzip-min-length: "1024"
  gzip-types: "application/json application/problem+json text/plain text/csv"
  enable-brotli: "true"
  brotli-level: "4"
  brotli-types: "application/json application/problem+json text/plain text/csv"

using Microsoft.AspNetCore.Antiforgery;
using Microsoft.AspNetCore.Http.Features;
using Microsoft.AspNetCore.ResponseCompression;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAntiforgery();
builder.Services.AddResponseCompression(options =>
{
    options.EnableForHttps = true;
    options.MimeTypes = ResponseCompressionDefaults.MimeTypes.Concat(["application/problem+json", "text/csv"]);
});

var app = builder.Build();
app.UseResponseCompression();

app.MapGet("/orders/{id:int}", (int id) =>
    TypedResults.Ok(new { id, customerId = "CUST-0042", total = 129.50m }));

// Echoes the caller's input next to a per-session secret: never compress over HTTPS.
app.MapGet("/checkout/session", (HttpContext context, IAntiforgery antiforgery, string returnUrl) =>
{
    context.Features.Get<IHttpsCompressionFeature>()!.Mode = HttpsCompressionMode.DoNotCompress;
    var tokens = antiforgery.GetAndStoreTokens(context);
    // returnUrl is untrusted: validate it as a local URL before any client redirects to it.
    return TypedResults.Ok(new { returnUrl, antiforgeryToken = tokens.RequestToken });
});

app.Run();

using System.Security.Claims;
using Microsoft.EntityFrameworkCore;

public sealed class Order
{
    public int Id { get; set; }
    public string CustomerId { get; set; } = "";
    public DateTimeOffset PlacedAt { get; set; }
    public decimal Total { get; set; }
    public string Status { get; set; } = "";
    public string ShippingAddressJson { get; set; } = "";
    public string InternalNotes { get; set; } = "";
}

public sealed record OrderSummary(int Id, DateTimeOffset PlacedAt, decimal Total, string Status);
public sealed record OrderPage(IReadOnlyList<OrderSummary> Items, int? NextAfterId);

public sealed class OrdersDb(DbContextOptions<OrdersDb> options) : DbContext(options)
{
    public DbSet<Order> Orders => Set<Order>();

    // The keyset query filters on CustomerId and seeks on Id: this index serves both.
    protected override void OnModelCreating(ModelBuilder modelBuilder) =>
        modelBuilder.Entity<Order>().HasIndex(o => new { o.CustomerId, o.Id });
}

public static class OrderListEndpoint
{
    private const int MaxPageSize = 100;

    // Map with .RequireAuthorization(); the customer comes from the token, never the query
    // string, so a caller cannot page through another customer's orders.
    public static async Task<IResult> ListAsync(
        OrdersDb db, ClaimsPrincipal user, int? afterId, int? limit, CancellationToken ct)
    {
        var customerId = user.FindFirstValue("customer_id");
        if (customerId is null) return TypedResults.Forbid();

        var size = Math.Clamp(limit ?? 25, 1, MaxPageSize);
        var items = await db.Orders
            .AsNoTracking()
            .Where(o => o.CustomerId == customerId && o.Id > (afterId ?? 0))
            .OrderBy(o => o.Id)
            .Take(size)
            .Select(o => new OrderSummary(o.Id, o.PlacedAt, o.Total, o.Status))
            .ToListAsync(ct);
        return TypedResults.Ok(new OrderPage(items, items.Count == size ? items[^1].Id : null));
    }
}