On: Nginx 1.5.10 released with SPDY 3.1 support

[hobohacker]

Let's be clear that the original CRIME attack was against request header secrets. Therefore, disabling response header compression (as nginx defaults to) does not prevent that. SPDY/3.1 request header compression is a client-side choice, not server-side.

[BobVerg → hobohacker]

CRIME attack isn't specific to request or response. If you pass secrets in response headers, then the attack can be performed against them.

[hobohacker → BobVerg]

That's true, which is why I was careful to say in its original form :) Since the original attack was on cookies (request headers). To my knowledge, no other SPDY server defaults response header compression to off. But yeah, if your application does pass secrets in response headers, you should be careful.