4 ms·
One issue is that you should not use any compression (http or tls) on a request/response with any sensitive info, such as session ids or csrf tokens (see beast,
by elchief 12y ago
One issue is that you should not use any compression (http or tls) on a request/response with any sensitive info, such as session ids or csrf tokens (see beast, crime attacks).
It's easy to turn off compression on your www domain and turn it on on your cdn domain.
So now you're not compressing your css, which would slow the response time, but by how much I can't say. You could still use css minification.
- bluesmoon 12y agoyou're confusing content compression with header compression. it's fine to pre-gzip your css before serving it over http or tls.
- elchief 12y agoHTTP compression is simply not safe on your main web domain: http://security.stackexchange.com/questions/20406/is-http-compression-safe http://security.stackexchange.com/questions/20406/is-http-co... What I was trying to say is that, if you're security conscious, and running a CDN anyway, it might not be worth the risk to allow (selective) HTTP compression on your main web domain. It would be safer to disable it completely.