Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Don't use HTTP compression on private responses when using TLS. It's okay to HTTP compress publicly available images/scripts/stylesheets


Well, be careful that it is just the body that gets compressed.

The vulnerability occurs when the cookie is part of the compression payload. Although that does depend on the attacker being able to control what gets sent.


Probably best to serve your public/static content on a cookie-less domain, so your session cookie is not sent on those requests.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: