I have been reading on CRIME and BREACH attacks and I want to learn better how to protect against them.

From what I understood, those attacks require TLS encryption over HTTP compression and HTTP content reflecting an user input.

HTTP/2 uses HPACK and HTTP/3 uses QPACK header compressions, which are secure against CRIME and BREACH. If my secret data is only inside headers, does that mean that I can safely use compression on the whole request / response, with HTTP/2 or HTTP/3?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.