My understanding is that the 'gzip' directive applies to HTTP compression, which is only performed on the body of the response (both in HTTP & HTTPS), and not S

My understanding is that the 'gzip' directive applies to HTTP compression, which is only performed on the body of the response (both in HTTP & HTTPS), and not SSL/TLS compression which compresses the headers and so is vulnerable to the CRIME attack. SSL/TLS compression has been disabled in nginx since 1.3.2[1] [1] http://mailman.nginx.org/pipermail/nginx-announce/2012/000087.html http://mailman.nginx.org/pipermail/nginx-announce/2012/00008...