On: Hypertext Transfer Protocol Version 2

[girvo]

I was going through that article after you posted it... is BREACH still an exploit in the wild? Turning off compression altogether seems painful :/

[AlyssaRowan → girvo]

Well, the exploit doesn't just go away.

Any context compressor could introduce the same hole if attacker-provided and sensitive data share contexts.

Specific countermeasures include salting your anti-CSRF tokens (so make sure they're not consistent but differ on every page load!).