My server is centos 7.4,with Apache 2.4.6,PHP 5.4,Mysql 5.5.
I plan to use mod_deflate
to compress websites file as below:
<IfModule mod_deflate.c>
DeflateCompressionLevel 3
AddOutputFilterByType DEFLATE text/html text/xml text/css text/xml text/javascript application/x-javascript application/x-httpd-php
AddOutputFilter DEFLATE css js html htm xml
BrowserMatch ^Mozilla/4 gzip-only-text/html
BrowserMatch ^Mozilla/4\.0[678] no-gzip
BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
SetEnvIfNoCase Request_URI \\.(?:gif|jpe?g|png)$ no-gzip dont-vary
SetEnvIfNoCase Request_URI .(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary
SetEnvIfNoCase Request_URI .(?:pdf|mov|avi|mp3|mp4|rm)$ no-gzip dont-vary
Header append Vary User-Agent env=!dont-vary
</IfModule>
I think everything is ok but when I read this post:
Some web applications are vulnerable to an information disclosure attack when a TLS connection carries deflate compressed data. For more information, review the details of the "BREACH" family of attacks.
I am not a professional, I just want to know is there a way to safely use TLS HTTPS with compress function?
Thanks in advance!
0 Answers