mitigate_breach_attack.patch

+++ nginx/src/http/modules/ngx_http_gzip_filter_module.c
@@ -150,7 +150,7 @@
       ngx_http_types_slot,
       NGX_HTTP_LOC_CONF_OFFSET,
       offsetof(ngx_http_gzip_conf_t, types_keys),
-      &ngx_http_html_default_types[0] },
+      NULL },

     { ngx_string("gzip_comp_level"),
       NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,

+++ nginx/conf/nginx.conf
@@ -31,6 +31,13 @@
     keepalive_timeout  65;

     #gzip  on;
+    # You have to explicitely enable compression on `text/html'
+    # Please look at https://trac.nginx.org/nginx/ticket/1083
+    # To mitigate BREACH vulnerability, you need to enable length hiding
+    # See: https://web.archive.org/web/20170311132458/http://dark-net.net/?p=49
+    #gzip_types text/html;
+    #length_hiding on;
+    #length_hiding_max 1024;

     server {
         listen       80;