Skip to content

Commit fc66cdf

Browse files
authored
Comment on disabling compression when using HTTPS (#123877)
The lack of context here left me at a dead end. I didn't RTFM otherwise I would have discovered #56899 added this info there, but for the sake of future code-readers I'm adding the same info here.
1 parent 9431c67 commit fc66cdf

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/transport/SecurityHttpSettings.java

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@ public final class SecurityHttpSettings {
1616
private SecurityHttpSettings() {}
1717

1818
public static void overrideSettings(Settings.Builder settingsBuilder, Settings settings) {
19+
// HTTP response compression over TLS risks side-channel vulnerabilities such as BREACH[1] if ES is used in very specific ways. We
20+
// cannot be sure that ES is not being used in such a manner here, so we disable compression by default when TLS is enabled for the
21+
// REST layer and rely on the user explicitly setting `http.compression: true` to confirm that they do not have a vulnerable
22+
// usage pattern.
23+
//
24+
// [1] https://www.breachattack.com/
1925
if (HTTP_SSL_ENABLED.get(settings) && SETTING_HTTP_COMPRESSION.exists(settings) == false) {
2026
settingsBuilder.put(SETTING_HTTP_COMPRESSION.getKey(), false);
2127
}

0 commit comments

Comments
 (0)