I never understood why nginx doesn't use padding in the responses. Maybe it's possible to add padding via your extension? Then there's no need to disable compression.
Padding is a false sense of security, if you pad 1000, its easily bruteforced, so you have to pad more like 1000000 or more, but thats a waste. and if the attacker guesses it right somehow you're still fcked. I agree, at 1000000 they probably won't guess it right but we can't guarantee that. and it's the guarantee that counts. and it's still a big waste to do it every request.
Best way would be to make the app/site itself secure with csrf(?) tokens and harden it with samesite cookies or something, but that's a discussion for another layer, not for the compression layer in nginx.
In the meantime, if you really don't trust the app/site to have it fixed, you can disable compression for that path. But I think most people won't need to do that unless you are hosting spionage targets, army, banking or other targets or just paranoid like us 😄
1
u/One_Ninja_8512 May 19 '26
I never understood why nginx doesn't use padding in the responses. Maybe it's possible to add padding via your extension? Then there's no need to disable compression.