Skip to content

Instantly share code, notes, and snippets.

@nbeguier

nbeguier/nginx.conf

Last active May 2, 2021 13:58
Show Gist options
  • Save nbeguier/943a7b14eece23f21fa1fdf99934ab0e to your computer and use it in GitHub Desktop.
Save nbeguier/943a7b14eece23f21fa1fdf99934ab0e to your computer and use it in GitHub Desktop.
Download ZIP
[DEPRECATED] Nginx : BREACH protection
Raw
nginx.conf
# Disable gzip compression
gzip off;
@khokm
Copy link

khokm commented May 2, 2021 •
edited

Just randomly found this. I have several questions:

  1. Why is it deprecated? Isn't BREACH attack still actual in 2021?
  2. If it's actual, why disable gzip for everything? Static resources, that everyone can have access to doesn't need any authentication data, so, we can gzip them (and disable gzip only for php responces, proxy_pass locations etc).

@nbeguier
Copy link
Author

nbeguier commented May 2, 2021

Hello !
You have probably right. For the first point, finding information about BREACH after 2013 is complicated. I assumed TLS1.1 has addressed the issue. If it's not the case, I may have wrong.
About the second point, indeed, it's a lazy method. Disabling gzip compression fix the problem, but it's the worst trade-off. Some alternative are disabling only where secrets are replyed or randomize the length of the response.

I have chosen to deprecate it because obviously nobody seriously disable gzip in production and address this issue. Even ssllabs ignore it.

Have a nice day, and thanks for your reply, very interesting

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment