Nginx quick reference

Re:Nginx quick reference by sschueller on Friday February 08, 2019 @03:20AM (#19112399)

"Disable compression (mitigation of CRIME attack)"

Is this really the best solution? This might get me an A+ at ssllabs but I also need an "A" from gtmetrics[1] and if I turn of gzip I will not get an A.

[1] https://gtmetrix.com/enable-gzip-compression.html

[ Parent | on HN ]

Re:Nginx quick reference by reacharavindh on Friday February 08, 2019 @04:18AM (#19112643)

I was surprised to read that as well. I have gzip compression "turned on" in all of the nginx servers I administered. Didn't even know it could be an attack vector.

https://www.acunetix.com/vulnerabilities/web/crime-ssl-tls-a...

[ Parent | on HN ]

Re:Nginx quick reference by ktpsns on Friday February 08, 2019 @05:20PM (#19119228)

What's probably worth saying is that (at least for Apache), you can enable compression only for certain file types, such as static text files (HTML/CSS/JS) but not dynamic files (thinking of classical CGI scripting -- PHP/Python/Ruby). It should be possible to seperate this also for modern-world fcgi services.

How does HTTP2 and HTTP3 perform in this question? I always percieved deflate/gzip compression as something preferable. I never realized the CRIME attack before.

[ Parent | on HN ]

Re:Nginx quick reference by philcrump on Saturday February 09, 2019 @04:51AM (#19121577)

My understanding is that the 'gzip' directive applies to HTTP compression, which is only performed on the body of the response (both in HTTP & HTTPS), and not SSL/TLS compression which compresses the headers and so is vulnerable to the CRIME attack.

SSL/TLS compression has been disabled in nginx since 1.3.2[1]

[1] http://mailman.nginx.org/pipermail/nginx-announce/2012/00008...

[ Parent | on HN ]