One of our automated pen test tools picked up a potential BREACH attack in one of our applications. (BREACH is similar to CRIME and takes advantage of HTTP compression.)
My fix for this was to ensure the content length of the request always varies by appending a new query string parameter 'token' with a random string of random length (1 - 10 chars). The idea behind this is that if the attacker cannot be sure if the request sizes are constant, they cannot exploit the flaw. This came back clear from the scan but I was wondering - is this the best fix?
[updated] An attacker theoretically capture this (eg Fiddler) and modify this and bypass my security mechanism. The server does not know what value is expected, any value of any length could be passed in, the JS just randomises a string.