Category Archives: compression

Is an API vulnerable to BREACH if HTTP compression is only enabled for endpoints that are authenticated using bearer tokens?

Posted on by

Let’s assume an API returns sensitive information (e.g. medical or financial) to authenticated users only.
In some circumstances responses may include information the user supplied in the request (e.g. if the user updates some text propert… Continue reading Is an API vulnerable to BREACH if HTTP compression is only enabled for endpoints that are authenticated using bearer tokens?→

WinZip AE-2 for small files and AE-1 for larger – how small/how large for each? [closed]

Posted on by

I’m adding password protection/encryption support to a Python package that makes ZIP files (https://github.com/uktrade/stream-zip). I’m opting to not add ZipCrypto support, but instead add WinZip-style AES
From https://www.winzip.com/en/su… Continue reading WinZip AE-2 for small files and AE-1 for larger – how small/how large for each? [closed]→