8 ms·
Aren't there any security risks when using this over HTTPS, considering past attacks like BREACH and CRIME?
by harsh1618 11y ago
Aren't there any security risks when using this over HTTPS, considering past attacks like BREACH and CRIME?
- cbr 11y agoCRIME: TLS compression can reveal private headers, like auth cookies. Fixed by turning off TLS compression. Not applicable to HTTP because HTTP never had header compression. BREACH: Response body compression of a page where there's (a) something attacker controlled, (b) something private and unchanging in the body can reveal that secret, and (c) response length is visible to an attacker. Doesn't require HTTPS. If an attack applied, it would be one like BREACH. Which isn't surprising: this is a direct replacement for "Accept-Encoding: gzip / Content-Encoding: gzip" and so we should expect it to be in the same security situation.
- nly 11y agoI think as long as you're not compressing secrets and attacker controlled data together you're fine.