4 ms·
Ask HN: Is it bad practice in 2023 to force GZIP compression?
I have setup an nginx reverse proxy to only ever call for and cache gzipped responses from the upstream server.
I have seen some older posts about forcing gzip on all requests but unzipping the pre-compressed content if the client specifically requests non-gzipped content.
I am considering not implementing the above sentence for performance reasons.
How impactful will essentially ignoring browser gzip preferences affect my user's experience?
I am under the impression that only computers running 20+ year old browsers will be affected by the inability to decompress gzipped content.
Is there anything else I am not thinking of? Do any clients not enable gzip for a good reason I am not thinking of? Thank you!
- josephcsible 3y agoForget about compatibility for a minute. Aren't you opening yourself up to attacks like CRIME and BREACH by ignoring clients' requests to not use compression?
- cjbprime 3y agoI think you found the "good reason I am not thinking of", nice work.
- SahAssar 3y agoThat requires some pretty specific prerequisites to be vulunerable: https://security.stackexchange.com/questions/65625/current-state-of-breach-gzip-ssl-attack https://security.stackexchange.com/questions/65625/current-s... Just set same-site cookies and enable compression, but of course honor requests for uncompressed responses for compatibility.
- johnnyApplePRNG 3y agoCompatibility with what or who though is my main question? What client in 2023 is asking for uncompressed content and why?
- SahAssar 3y agoA lot of non-browser clients. curl defaults to it, many http clients in many programing languages default to it. Some can handle a compressed response anyway, but it's not what they asked for.