[BUG] HTTP REST API hangs with Accept-Encoding zstd

[jgough]

Describe the bug

As of v2.19.1, when using the OpenSearch Dashboards REST API and zstd is in the Accept-Encoding headers, the response from the OpenSearch Dashboards API hangs.

This seems very similar to opensearch-project/OpenSearch#17339

Have seen this breaking when using traefik as a proxy which seems to automatically insert zstd into the header. This means that OpenSearch Dashboards will not work with traefik.

To Reproduce
Steps to reproduce the behavior:

1. With developer tools open in your favourite browser, load OpenSearch Dashboards
2. Inspect the network requests and look for the request to /api/core/capabilities
3. Right click the request, copy as curl
4. At the command prompt, paste the curl command. Observe that this returns as normal
5. Modify the curl command and add zstd to the Accept-Encoding header
6. Note that with this modified request the API hangs and does not return a response

Expected behavior
Here is the request working without zstd in the Accept-Encoding (truncated for brevity):

$ curl -v 'http://localhost:5601/api/core/capabilities' --compressed -X POST ... -H 'Accept-Encoding: gzip, deflate' ...
*   Trying 127.0.0.1:5601...
* Connected to localhost (127.0.0.1) port 5601 (#0)
> POST /api/core/capabilities HTTP/1.1
> Host: localhost:5601
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
> Accept: */*
> Accept-Language: en-GB,en;q=0.5
> Accept-Encoding: gzip, deflate
> Referer: http://localhost:5601/app/home
> Content-Type: application/json
> osd-version: 2.19.1
> osd-xsrf: osd-fetch
> Origin: http://localhost:5601
> DNT: 1
> Sec-GPC: 1
> Connection: keep-alive
> Cookie: security_authentication=…….
> Priority: u=4
> Pragma: no-cache
> Cache-Control: no-cache
> Content-Length: 819
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< osd-name: opensearch
< content-type: application/json; charset=utf-8
< cache-control: private, no-cache, no-store, must-revalidate
< set-cookie: security_authentication=...; HttpOnly; Path=/
< vary: accept-encoding
< content-encoding: gzip
< Date: Fri, 14 Mar 2025 09:18:20 GMT
< Connection: keep-alive
< Keep-Alive: timeout=120
< Transfer-Encoding: chunked
<
{"navLinks":{"error":true,"status":true,"kibana":true,...

And when zstd is added:

$ curl -v 'http://localhost:5601/api/core/capabilities' --compressed -X POST ... -H 'Accept-Encoding: gzip, deflate, zstd' ...
*   Trying 127.0.0.1:5601...
* Connected to localhost (127.0.0.1) port 5601 (#0)
> POST /api/core/capabilities HTTP/1.1
> Host: localhost:5601
> User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
> Accept: */*
> Accept-Language: en-GB,en;q=0.5
> Accept-Encoding: gzip, deflate, zstd
> Referer: http://localhost:5601/app/home
> Content-Type: application/json
> osd-version: 2.19.1
> osd-xsrf: osd-fetch
> Origin: http://localhost:5601
> DNT: 1
> Sec-GPC: 1
> Connection: keep-alive
> Cookie: security_authentication=...
> Priority: u=4
> Pragma: no-cache
> Cache-Control: no-cache
> Content-Length: 819
>

=> (REQUEST HANGS, NO RESPONSE)

OpenSearch Version
2.19.1

Dashboards Version
2.19.1

Plugins

$ opensearch-dashboards-plugin list
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Host/Environment (please complete the following information):

• OS: Linux, x86_64 in Docker (using official opensearchproject/opensearch:2.19.1 image)
• Firefox 128.8.0esr, curl 7.79.1, Chrome 133.0.6943.142

Additional context

This looks like this was fixed in OpenSearch API itself in 2.19.1 but the problem still appears to persist in the OpenSearch Dashboards API