Tag: compression

BREACH is a compression side-channel attack that can leak CSRF tokens and other secrets over HTTPS. Here is how the BREACH attack works, why padding is weak protection, and how to prevent it properly.

Zstd is the fast compression format suddenly showing up in browsers, package managers, and modern web stacks. Here is what it is, where it came from, which browsers and web servers support it, and how to use it with NGINX and Angie today.

Zstd vs Brotli vs zlib-ng only makes sense once you separate browser encodings from compression engines. This deep dive covers support, CPU trade-offs, static vs dynamic compression, and the NGINX production patterns that actually work.

Brotli achieves 15-26% better compression than gzip on HTML, CSS, and JavaScript. This guide covers installing the NGINX Brotli module, configuring on-the-fly compression, pre-compressing static assets at level 11, and running Brotli alongside gzip.

The first audit found 22 issues, but the last two weeks of git history added 14 more issue-level fixes. This updated guide covers the full 36-issue fork-window story, the runtime and build bugs, and the CI tests now guarding the module.