CRIME and BREACH attacks, HTTP/2 and HTTP/3

[alexandrehtrb]

Hello,

I have been reading on CRIME and BREACH attacks and I want to learn better how to protect against them.

From what I understood, those attacks require TLS encryption over HTTP compression and HTTP content reflecting an user input.

My questions are:

1. HTTP/2 uses HPACK and HTTP/3 uses QPACK header compressions, which are secure against CRIME and BREACH. If my secret data is only in headers, does that mean that I can safely use HTTP compression, with HTTP/2 or HTTP/3?

2. If only a part of the HTTP response is compressed (e.g., the body), but the secrets are not compressed, is it safe?

[Xyncgas]

Spectre is still not fixed it's dommed
My speculation is the vulnerability wouldn't exist if you are not using its attack surface
if you are using a secure method of compression then it's secure