Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gzip]

Gzip is a software application/method used to compress data. Gzip is acronym for GNU zip. Gzip is based on DEFLATE algorithm, a combination of LZ77 a Huffman coding.

6
votes
1answer
2k views

To avoid BREACH, can we use gzip on non-token responses?

I work on a site that has a web interface an an API. I'm trying to determine if we can safely use gzip, or if that will open us to BREACH. The site says: If you have an HTTP response body that ...
13
votes
1answer
718 views

Brotli compression algorithm and BREACH attack

I spent a lot of time on BREACH attack implementations. In theory, Brotli compression, like other compressions that use lzz7 family algorithms, must be vulnerable to the BREACH attack. Experiences ...
4
votes
1answer
173 views

Are there valid reasons for compressed files (zip, gzip, etc.) to spoof file size?

Zip files, GZip files, and likely others, include information about the contained file, including the uncompressed size of the file. However, when extracting these files the number is meaningless as ...
3
votes
3answers
166 views

is g-zipping assets a security concern?

I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website. I brought this to the attention of the networking ...
13
votes
3answers
7k views

Is gzipping content via TLS allowed?

So I have these few compression directives at http level in nginx: gzip on; gzip_http_version 1.1; gzip_vary on; I read that this should be avoided because of CRIME/BREACH attack, is this correct?