0

Should you compress the body of a HTTPS response before passing it to openssl? C++

I am aware of the attacks that are made possible by compressing a HTTP(s) response as explained over here. But according to Compression in HTTP you should compress the (body of a) HTTP response.

So I am a little confused if the attacks are also possible when you merely compress the body of an HTTP(s) response, and not the headers?

user283071
  • 1
  • You are basically asking about BREACH attack. In short: compressing static content is fine. Compressing content which does not contain secrets is fine too. Compress dynamic content with secrets is fine as long as it does not contain content which might be controlled by an attacker observing the encrypted traffic. – Steffen Ullrich Sep 21 '22 at 17:10

0 Answers0