6

BREACH, a new attack on SSL that targets HTTP compression, has recently been publicly announced. The emerging advice for how to defend against BREACH seems to be: turn off HTTP compression.

So, how do I turn off HTTP compression? What changes do I need to make to my Apache configuration? Do I need to make any changes to browsers, too?

(While I'm here, are there any other resources suggesting what changes should be made on other web servers, like Microsoft IIS?)

Improve this question
0

1 Answer 1

Reset to default
6

Apache compression is handled by mod_deflate. Just don't load or enable the module and Apache won't apply HTTP compression. Other compression (such as done within PHP) may be a bit more complicated, but BREACH deals specificly with mod_deflate-style compression.

There is also mod_gzip, which is much less popular.

Improve this answer
3
  • 2
    Don't just switch to gzip; you can be sure this attack will be adapted quickly enough.
    – Michael Hampton
    Aug 3, 2013 at 16:18
  • 2
    @MichaelHampton The point wasn't switch to mod_gzip, but rather also disable mod_gzip.
    – tylerl
    Aug 3, 2013 at 18:59
  • Note that if you serve both secure and non-secure content (whether this is a good practice is a different discussion, but I digress), this will disable compression for all content, which may not be what you want.
    – Moshe Katz
    Aug 8, 2013 at 0:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.