# Is SSL and Compression never secure in nginx? **URL:** \ **Category:** NGINX\ **Created:** [July 27, 2015, 5:25pm UTC](https://www.ruby-forum.com/t/is-ssl-and-compression-never-secure-in-nginx/242794 "2015-07-27T17:25:02Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\ **Post date:** [July 27, 2015, 5:25pm UTC](https://www.ruby-forum.com/t/is-ssl-and-compression-never-secure-in-nginx/242794/1 "2015-07-27T17:25:02Z")
Hi, I am working in a project where a password-protected extranet application is behind an nginx proxy using ssl. Now I asked the admin to enable server-side http-compression because we tend to have rather lengthy json responses from our REST api and they compress very well and the performance gain would be significant. He decline doing that, explaining that because of the CRIME vulnerability, it is not a good idea to enable compression when using ssl with nginx. Is this really always the case? Are there scenarios where the vulnerability is not a problem? I am trying to understand this better to make an informed decision because not using compression (encryption is a must) would incur other costs (optimizations in the code) and I don’t just want to waste that time and money unless I have to. Thanks in advance, Robert ---
**Author:** ![Robert\_KrS\_ger](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/47e85d/32.png) [@Robert\_KrS\_ger](https://www.ruby-forum.com/u/Robert_KrS_ger)\ **Post date:** [July 27, 2015, 7:34pm UTC](https://www.ruby-forum.com/t/is-ssl-and-compression-never-secure-in-nginx/242794/2 "2015-07-27T19:34:43Z")
Hello! On Mon, Jul 27, 2015 at 05:24:21PM +0200, Robert Krüger wrote: > really always the case? Are there scenarios where the vulnerability is not > a problem? I am trying to understand this better to make an informed > decision because not using compression (encryption is a must) would incur > other costs (optimizations in the code) and I don’t just want to waste that > time and money unless I have to. The CRIME attack only applies when you are using SSL compression, which is always off in nginx. There is a similar attack on gzip http compression, BREACH. It only applies if you return sensitive data in a response with some user-controlled data, and compress them together. Such attacks usually can be more or less easily mitigated by either not compressing sensitive responses (nginx allows to control gzip compression on a per-location basis) or implementing some rate limits (like limit\_req). See here for more details: > **[BREACH](https://en.wikipedia.org/wiki/BREACH_(security_exploit))** > > BREACH (a backronym: Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) is a security vulnerability against HTTPS when using HTTP compression. BREACH is built based on the CRIME security exploit. BREACH was announced at the August 2013 Black Hat USA conference by security researchers Angelo Prado, Neal Harris and Yoel Gluck. While the CRIME attack was presented as a general attack that could work effectively against a large number of protocols, only exploits against S... – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![Robert\_KrS\_ger](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/47e85d/32.png) [@Robert\_KrS\_ger](https://www.ruby-forum.com/u/Robert_KrS_ger)\ **Post date:** [July 28, 2015, 10:14am UTC](https://www.ruby-forum.com/t/is-ssl-and-compression-never-secure-in-nginx/242794/3 "2015-07-28T10:14:28Z")
OK, thanks a lot for the feedback. That helped. I will try to find out if one of the “fixes” applies to our case. ---
**Author:** ![Robert\_KrS\_ger](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/47e85d/32.png) [@Robert\_KrS\_ger](https://www.ruby-forum.com/u/Robert_KrS_ger)\ **Post date:** [July 27, 2015, 7:36pm UTC](https://www.ruby-forum.com/t/is-ssl-and-compression-never-secure-in-nginx/242794/4 "2015-07-27T19:36:28Z")
CRIME has been superseeded by BREACH, and it is in no way related to any specific Web server, but to the more general concepts of TLS-encrypted (gzip-?)compressed HTTP content (SPDY is fine). On the following website you will get all the details as well as a cheat-sheet list of ideas to mitigate it. Disabling gzip compression when encrypting HTTP content is one idea. > **[BREACH ATTACK](https://www.breachattack.com/)** > > SSL, GONE IN 30 SECONDS — A BREACH beyond CRIME ## ​The baseline is: nginx in itself has nothing to do with it.​ _B. R._