I have a single page application that is hosted at example.com that relies on api.example.com. The SPA sends user credentials (JWT token) in authorization header for every request.
Let's suppose that the APIs have an endpoint (api.example.com/search) that would take user supplied input and return the input back in the response.
I am trying to understand if the APIs would be vulnerable to BREACH attack if I enable compression on the API server. How so?