A Solution to Compression Oracles on the Web

What this post added

Introduced `cf-nocompress`, a proof-of-concept NGINX plugin that selectively disables compression for data identified as secret by regular expressions. This mitigates compression oracle attacks (CRIME, BREACH, TIME, HEIST) by preventing sensitive data like CSRF tokens from being added to the compression dictionary, thus preventing attackers from inferring secret content based on response length. The solution aims for transparency and minimal impact on overall compression effectiveness.