3 ms·
Don't use HTTP compression on private responses when using TLS. It's okay to HTTP compress publicly available images/scripts/stylesheets
by elchief 13y ago
Don't use HTTP compression on private responses when using TLS. It's okay to HTTP compress publicly available images/scripts/stylesheets
- wglb 13y agoWell, be careful that it is just the body that gets compressed. The vulnerability occurs when the cookie is part of the compression payload. Although that does depend on the attacker being able to control what gets sent.
- elchief 13y agoProbably best to serve your public/static content on a cookie-less domain, so your session cookie is not sent on those requests.