import type { IncomingMessage, ServerResponse } from "http";
const MIN_BYTES = 1024;
const INCOMPRESSIBLE = /^(image|video|audio)\/|application\/(zip|gzip|x-brotli|pdf|octet-stream)/i;
const TEXT_LIKE = /^(text\/|application\/(json|javascript|xml|graphql)|image\/svg)/i;
export function shouldCompress(req: IncomingMessage, res: ServerResponse): boolean {
const type = String(res.getHeader("Content-Type") || "");
if (INCOMPRESSIBLE.test(type)) {
return false;
}
const rawLength = res.getHeader("Content-Length");
if (rawLength === undefined) {
// Streamed/chunked response: only compress predictable text payloads.
return TEXT_LIKE.test(type);
}
const length = Number(rawLength);
if (Number.isFinite(length) && length < MIN_BYTES) {
return false;
}
return true;
}
import compression from "compression";
import type { Request, Response, RequestHandler } from "express";
import { shouldCompress } from "./compressionPolicy";
export function adaptiveCompression(): RequestHandler {
return compression({
threshold: 0, // size gating is handled entirely by our policy
filter(req: Request, res: Response): boolean {
if (res.locals.noCompression === true) {
return false;
}
// Never re-encode assets that arrive already compressed.
if (res.getHeader("Content-Encoding")) {
return false;
}
return shouldCompress(req, res);
},
});
}
import express, { Request, Response } from "express";
import { adaptiveCompression } from "./adaptiveCompression";
const app = express();
app.use(adaptiveCompression());
app.get("/api/report", (_req: Request, res: Response) => {
const rows = Array.from({ length: 5000 }, (_, i) => ({ id: i, label: `row-${i}` }));
res.json({ generatedAt: Date.now(), rows });
});
app.get("/events", (_req: Request, res: Response) => {
res.locals.noCompression = true; // SSE must flush immediately, not buffer
res.set({
"Content-Type": "text/event-stream",
"Cache-Control": "no-cache",
Connection: "keep-alive",
});
const timer = setInterval(() => {
res.write(`data: ${JSON.stringify({ ts: Date.now() })}\n\n`);
}, 1000);
res.on("close", () => clearInterval(timer));
});
app.listen(3000, () => console.log("listening on :3000"));
This snippet shows a small compression layer for an Express server that only compresses responses when doing so is actually worthwhile. Naive compression() usage wastes CPU compressing tiny payloads, already-compressed formats like JPEG or MP4, and streamed responses where buffering hurts latency. The three tabs together implement a policy engine, a middleware that applies it, and the wiring that registers it.
In compressionPolicy.ts, shouldCompress centralizes the decision. It reads the Content-Type and Content-Length headers and returns false for anything under MIN_BYTES (1 KB), because the gzip header and CPU cost outweigh the savings on small bodies. It also rejects content types already matching INCOMPRESSIBLE — images, video, audio, and zip archives are entropy-dense and shrink by almost nothing. When Content-Length is absent (a streamed or chunked response) the policy is conservative and allows compression only for known text-like types, since compressing an unbounded stream can add latency for interactive endpoints. This keeps the rule readable and unit-testable in isolation from Express.
In adaptiveCompression.ts, the middleware delegates the buffered path to the standard compression package but supplies a custom filter backed by shouldCompress, so the library still handles content negotiation, Accept-Encoding parsing, and the actual gzip/brotli codecs. The wrapper also honors a per-response opt-out: handlers can set res.locals.noCompression = true (for example on Server-Sent Events) and the filter bails out early. Crucially it respects an existing Content-Encoding header so pre-compressed assets served from disk are never double-encoded, a common corruption bug.
In server.ts, the middleware is registered before the routes with a threshold of 0 because the size gate now lives entirely in the policy, avoiding two competing thresholds. The SSE route demonstrates the escape hatch by flagging res.locals.noCompression before streaming.
The trade-off is explicit: spend CPU only where bytes-on-the-wire genuinely drop. The main pitfall to watch is the BREACH attack surface — compressing responses that mix secrets with attacker-controlled input — so security-sensitive endpoints should opt out via the same noCompression flag.
Related snips
export interface RetryOptions {
retries: number;
baseMs: number;
maxMs: number;
signal?: AbortSignal;
onRetry?: (attempt: number, delay: number, err: unknown) => void;Exponential backoff with jitter for retries
require "csv"
class PeopleCsvStream
include Enumerable
HEADERS = %w[id full_name email signed_up_at plan].freezeResilient CSV Export as a Streamed Response
Rails.application.configure do
config.after_initialize do
Bullet.enable = true
Bullet.alert = false
Bullet.bullet_logger = true
Bullet.console = trueN+1 query detection with Bullet gem
json.array! @posts do |post|
json.cache! ['v1', post], expires_in: 1.hour do
json.id post.id
json.title post.title
json.excerpt post.excerpt
json.published_at post.published_atFragment caching for expensive JSON serialization
import { randomBytes, createHash } from "crypto";
import jwt from "jsonwebtoken";
import { RefreshTokenStore } from "./store";
const ACCESS_SECRET = process.env.ACCESS_SECRET!;
const ACCESS_TTL = "15m";JWT access + refresh token rotation (conceptual)
package deps
import (
"net"
"net/http"
"time"HTTP client tuned for production: timeouts, transport, and connection reuse
Share this code
Here's the card — post it anywhere.
