I have been reading on CRIME and BREACH attacks and I want to learn better how to protect against them.

From what I understood, those attacks require TLS encryption over HTTP compression and HTTP content reflecting an user input.

HTTP/2 uses HPACK and HTTP/3 uses QPACK header compressions, which are secure against CRIME and BREACH. If my secret data is only inside headers, does that mean that I can safely use compression on the whole request / response, with HTTP/2 or HTTP/3?


You must log in to answer this question.

Browse other questions tagged .