3 ms·
I'm in the same boat - if the attacker could inject strings into requests pre-compression, then wouldn't the client already be compromised?
by veesahni 13y ago
I'm in the same boat - if the attacker could inject strings into requests pre-compression, then wouldn't the client already be compromised?
- rlucas 13y agoNo, you're missing that the original GET requests can be performed in some cases over HTTP, either by forgery or by surreptitiously spoofing the user's own browser into doing it. No need to have compromised the SSL/TLS.