>Further digging into CFs behaviour reveals: "The Accept-Encoding header is not respected and will be removed.". It appears they decide what to compress based o

>Further digging into CFs behaviour reveals: "The Accept-Encoding header is not respected and will be removed.". It appears they decide what to compress based on UA. Again, this doesnt sound like any upstream middlebox protection, as they strip the header anyway - i.e. it never gets forwarded to origin, so its got nothing to do with upstream provider. Most browsers won't offer Brotli, hence UA Analysis is more reliable. >Point me at the issue in squid where it cant handle an unknown encoding. Not necessarily squid itself, but i know plenty of middleware boxes that have these issues, in part they are based on squid. Sophos is an example if you run an older box. > it could be they have applied this mitigation in reverse, to http instead of https. http://www.breachattack.com/#mitigations http://www.breachattack.com/#mitigations But where is proof of that >You are the one wanting to redefine what transport means. Not really, you're the one wanting to put the world into 7 boxes. >Its not - feel free to quote a single line from that article that talks about whether they are talking about transfer encoding or content encoding. Look for "How does CF handle Brotli?" then read the paragraph after. >Im not sure what you find rude about it? Your response was condescending at best. >Again, this doesnt sound like any upstream middlebox protection, as they strip the header anyway - i.e. it never gets forwarded to origin, so its got nothing to do with upstream provider. The middlebox will foward the UA in almost all cases, so from CF's perspective, a middlebox will look like a normal user agent with possible Brotli capabilities. I think you're confusing middleboxes and proxies with the reverse proxy people commonly put behind Cloudflare here, which while technically a middlebox is rarely called that.