Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You can still safely compress your static files. So, assuming that you don't send any secrets in your CSS, JS etc., you can configure your server to enable gzip only for these resources.

For example, when using nginx and with gzip off globally, you can do :

    location /static/ {
        gzip on;
        ...
    }


Would this really work? Won't they be sharing cookies unless the static files are on a different domain?


Doesn't matter if they share cookies. Static files reflect neither user-supplied data nor secrets in their contents, so they can't be used in a BREACH attack.


Additionally, you should be serving static files from a different domain anyway so that you can get the performance gains from cookie-less requests.


Can you point out some more info/sources on these performance gains?





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: