admin-api antispam stat endpoint not respecting Accept-Encoding

[mgkeeley]

The /api/v1/system/antispam/stat endpoint is always using Content-Encoding: zstd, even when Accept-Encoding: gzip, deflate is set.

This is causing a "Failed to fetch" error in the web ui.

VARIANT="grommunio appliance"
VARIANT_ID="appliance"
VERSION_ID="16.0"
VERSION="2026.06.1"

To reproduce:

curl --url 'http://localhost:8080/api/v1/system/antispam/stat' -H 'Accept-Encoding: gzip, deflate' -b 'grommunioAuthJwt=REDACTED' --output /dev/null -v 2>&1 | grep "Content-Encoding"
< Content-Encoding: zstd

[StefanAkie]

...what exactly are you talking about?
First of all it doesn't fail to fetch. Second of all, your request headers are default values. What exactly are you trying to do here.

[jengelh]

Due to what I now see as a packaging bug (no config file), zstd isn't currently even activated in nginx in openSUSE Leap 16.0.

# rpm -ql nginx-module-brotli
/usr/lib64/nginx/modules/ngx_http_brotli_filter_module.so
/usr/lib64/nginx/modules/ngx_http_brotli_static_module.so
/usr/share/doc/packages/nginx-module-brotli
/usr/share/doc/packages/nginx-module-brotli/CONTRIBUTING.md
/usr/share/doc/packages/nginx-module-brotli/README.md
/usr/share/licenses/nginx-module-brotli
/usr/share/licenses/nginx-module-brotli/LICENSE
/usr/share/nginx
/usr/share/nginx/modules
/usr/share/nginx/modules/mod-brotli.conf
# rpm -ql nginx-module-zstd
/usr/lib64/nginx/modules/ngx_http_zstd_filter_module.so
/usr/lib64/nginx/modules/ngx_http_zstd_static_module.so
/usr/share/doc/packages/nginx-module-zstd
/usr/share/doc/packages/nginx-module-zstd/README.md
/usr/share/licenses/nginx-module-zstd
/usr/share/licenses/nginx-module-zstd/LICENSE
# grep nginx/ /proc/37038/maps
7f0c76f04000-7f0c76f05000 rw-p 0002d000 08:02 471996                     /usr/lib64/nginx/modules/ngx_http_vhost_traffic_status_module.so
7f0c77236000-7f0c77237000 r--p 00000000 08:02 1435679                    /usr/lib64/nginx/modules/ngx_http_brotli_static_module.so
7f0c7723b000-7f0c7723d000 r--p 00000000 08:02 1435783                    /usr/lib64/nginx/modules/ngx_http_brotli_filter_module.so

So the web server is not even supposed to output zstd under these circumstances.

[mgkeeley]

...what exactly are you talking about? First of all it doesn't fail to fetch. Second of all, your request headers are default values. What exactly are you trying to do here.

Sorry, perhaps my wording wasn't clear in the original post. The message on the UI (in Chrome) is "Failed to fetch". This happens because Chrome doesn't include zstd in it's Accept-Encoding headers (vs. your Firefox screenshot, where zstd is included in Accept-Encoding).

My "reproduction" example is showing that a equivalent curl command, which sends the same Accept-Encoding as Chrome does, indeed receives a reply from the server, but that reply is using zstd encoding (which is what Chrome complains about).

[mgkeeley]

So the web server is not even supposed to output zstd under these circumstances.

Hmm, well it is being output on my system! I recently upgraded from 15.5 to 15.6, then upgraded to 16.0. Would that be different to a fresh install of 16.0?

I upgraded by updating refrences to 15.5 to 15.6 in /etc/zypp/repos.d/*.repo, then zypper dup. Following https://community.grommunio.com/d/1879-update-form-open-suse-155-to-156 made the other recommended changes.

It said in step 20 "Manually migrate the changes from the .rpmnew file into the original configuration file, this can be done with vim or diff."
The only relevant changes I can see was /etc/grommunio-web/config.php and /etc/php8/fpm/php-fpm.conf

cp /etc/grommunio-web/config.php.rpmnew /etc/grommunio-web/config.php
cp /etc/php8/fpm/php-fpm.conf.rpmnew /etc/php8/fpm/php-fpm.conf

But there is no zstd references in these config files.

Then I used grommunio-update upgrade to go from 15.6 to 16.0.

[mgkeeley]

I also checked the return headers from the curl command again:

GET /api/v1/system/antispam/stat HTTP/1.1
Host: localhost:8080

< Server: rspamd/4.1.5
< Date: Fri, 18 Sep 2026 23:44:39 GMT
< Cache-Control: no-store, no-cache, max-age=1
< Content-Encoding: zstd

So it seems that the repsonse is from rspamd (perhaps the api is just passing the response through?) this may explain why the nginx config doesn't include zstd and yet the response is still being returned zstd encoded.

rpm -ql nginx-module-zstd
package nginx-module-zstd is not installed

I also don't have zstd for nginx.

[mgkeeley]

Seems in rspamdProxy, the relevant requests headers (e.g. Accept-Encoding) are not being passed along; and then the raw response is being returned directly with res.raw.read()

admin-api/endpoints/system/misc.py

Lines 198 to 210 in 22aad89

	@API.route(api.BaseRoute+"/system/antispam/<path:path>", methods=["GET"])
	@secure()
	def rspamdProxy(path):
	checkPermissions(SystemAdminROPermission())
	conf = Config["options"]
	if path not in conf["antispamEndpoints"]:
	return jsonify(message="Endpoint not allowed"), 403
	try:
	res = requests.get(conf["antispamUrl"]+"/"+path, params=request.args, stream=True)
	except BaseException as err:
	API.logger.error(type(err).__name__+": "+" - ".join(str(arg) for arg in err.args))
	return jsonify(message="Failed to connect to antispam"), 503
	return res.raw.read(), res.status_code, res.headers.items()

Perhaps either pass the relevant headers from the original request, or decode the response before returning it?

[jengelh]

Internal ticket copy: vcs/admin-api/issues/326