mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-10-22 11:46:13 +00:00
Add Server::set_compress() to turn off handler response compression
A server built with compression support compressed every handler response the client accepted, with no way to turn it off. Over HTTPS the length of a compressed response can give away a secret in it when the same response also carries text an attacker chooses (BREACH). set_compress(false) sends handler responses, buffered or streamed, as they are; compression stays on by default, and static file compression keeps its own setting. The README and the cookbook describe the switch and when to use it.
This commit is contained in:
1 parent
3b8b9cf9d5
commit
fc37d3eae1
5 files changed
+67
-1
No files matched your search
@@ -48,6 +48,14 @@ svr.Get("/events", [](const httplib::Request &req, httplib::Response &res) {
|
||||
});
|
||||
```
|
||||
|
||||
## Turning it off
|
||||
|
||||
```cpp
|
||||
svr.set_compress(false);
|
||||
```
|
||||
|
||||
Handler responses, buffered or streamed, are then sent as they are. Over HTTPS, the length of a compressed response can give away a secret in it, such as a CSRF token, when the same response also carries text an attacker can choose (the BREACH attack). Static file compression is set separately.
|
||||
|
||||
## Static files need to be opted in
|
||||
|
||||
Files served as they are, through `set_mount_point()` or `Response::set_file_content()`, are not compressed by default. Turn it on with:
|
||||
|
||||
Reference in new issue
Block a user