2 ms·
You'd have the same problem if HTTP supported compression of the request headers & body. It's because it only supports compression of the response body that the
by tlb 14y ago
You'd have the same problem if HTTP supported compression of the request headers & body. It's because it only supports compression of the response body that there isn't any leakage already.
- caf 14y agoThis is true, but it reinforces why the compression should not be done at the secure transport layer, and should instead be left to higher levels: only HTTP knows which parts of the request are potentially unsafe to include in the same compression state. (Even if HTTP probably just got lucky here rather than deliberately making the right choice, it's still the only layer that had the chance to make the right choice).