It seems that in a MITM attack, hackers may know the whole HTTPS packet size sent through the network (i.e. size of HTTP headers + HTTP body + overhead). Besides that, does the HTTPS protocol also allow the hacker to recover the length of the HTTP body (either compressed or not)?
I ask because this is related to whether or not "adding a string of random length to the HTTP header" can hide the compressed HTTP body's length, to mitigate (but I know cannot totally prevent) a BREACH attack.
If the answer is no, does anyone know other risks in placing the random-length string in the HTTP header, instead of in HTTP body, to mitigate a BREACH attack?