> (...)compression at the SSL level. HTTP also includes optional compression, but this one applies only to the body of the requests and responses, not the heade

> (...)compression at the SSL level. HTTP also includes optional compression, but this one applies only to the body of the requests and responses, not the header, and thus does not cover the Cookie: header line. HTTP-level compression is fine. Guess SPDY is also subject to similar attack -- given that it compresses headers just as well.