4 ms·
That requires some pretty specific prerequisites to be vulunerable: https://security.stackexchange.com/questions/65625/current-state-of-breach-gzip-ssl-attack h
by SahAssar 3y ago
That requires some pretty specific prerequisites to be vulunerable: https://security.stackexchange.com/questions/65625/current-state-of-breach-gzip-ssl-attack https://security.stackexchange.com/questions/65625/current-s...
Just set same-site cookies and enable compression, but of course honor requests for uncompressed responses for compatibility.
- johnnyApplePRNG 3y agoCompatibility with what or who though is my main question? What client in 2023 is asking for uncompressed content and why?
- SahAssar 3y agoA lot of non-browser clients. curl defaults to it, many http clients in many programing languages default to it. Some can handle a compressed response anyway, but it's not what they asked for.