The Backend Engineering Show with Hussein Nasser artwork

How HTTP Compression Leaks Sessions and JWT - CRIME Explained and how HPACK in HTTP/2 fixes this

The Backend Engineering Show with Hussein Nasser

English - March 19, 2021 20:57 - 21 minutes - 14.5 MB - ★★★★★ - 5 ratings
Technology Homepage Download Apple Podcasts Google Podcasts Overcast Castro Pocket Casts RSS feed
Previous Episode: The Second Microsoft Global Outage in less than 6 months
Next Episode: Why WebSockets over HTTP/2 (RFC8441) is Critical for Effective Load Balancing and Backend Scaling

In this video we will explore one of the most popular side attacks CRIME Compression Ratio Info-leak Made Easy) and the different ways to mitigate this.   Intro 0:00  * HTTP/1.1 SPDY header compression 4:00* TLS compression  * Response body attackers can’t inject 13:00  * Mitigations  14:10      * HPACK/QPACK      * TLS Padding