I have a single page application that is hosted at example.com that relies on api.example.com. The SPA sends user credentials (JWT token) in authorization header for every request.

Let's suppose that the APIs have an endpoint (api.example.com/search) that would take user supplied input and return the input back in the response.

I am trying to understand if the APIs would be vulnerable to BREACH attack if I enable compression on the API server. How so?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.