3 ms·
You can still safely compress your static files. So, assuming that you don't send any secrets in your CSS, JS etc., you can configure your server to enable gzip
by maciejgryka 13y ago
You can still safely compress your static files. So, assuming that you don't send any secrets in your CSS, JS etc., you can configure your server to enable gzip only for these resources.
For example, when using nginx and with gzip off globally, you can do :
location /static/ {
gzip on;
...
}
- ludwigvan 13y agoWould this really work? Won't they be sharing cookies unless the static files are on a different domain?
- agwa 13y agoDoesn't matter if they share cookies. Static files reflect neither user-supplied data nor secrets in their contents, so they can't be used in a BREACH attack.
- andrewingram 13y agoAdditionally, you should be serving static files from a different domain anyway so that you can get the performance gains from cookie-less requests.
- bobwaycott 13y agoCan you point out some more info/sources on these performance gains?
- andrewingram 13y agohttps://developers.google.com/speed/docs/best-practices/request#ServeFromCookielessDomain https://developers.google.com/speed/docs/best-practices/requ...