'ASP Net Core HTTPS Compression Vulnerabilities - BREACH & CRIME
I have an ASP.NET Core 3.1 application. Server - IIS and Kestrel (We are going to docker soon, so it will be Kestrel server) The application(service) is a plain API. This API(service) is responsible for authentication, data processing. So basically we send this data to the Browser(client)
Our SEO + Devops said that we need to improve API layer performance. I went to the MSDN page and found Response compression So I added the HTTP and HTTPS compression. Then I scroll down the page and found vulnerabilities when using compression. It says that if I use HTTPS compression for dynamically generated pages then it could cause a vulnerability such as BREACH & CRIME.
So basically I want to ask - Is this a vulnerability I have to be careful of? Should I implement some workaround if this is still a valid vulnerability for ASP.NET Core 3.1? Is it different for IIS and Kestrel?
P.s. Thank everyone for the help.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
