Only enable gzip for HTML/CSS/JS

No compression on JSON endpoints, in order to protect
from potential compression+encryption data leak attacks (like BREACH)

1 files changed, 4 insertions, 2 deletions

diff --git a/support/nginx/peertube b/support/nginx/peertube
index 1b698576f..0720dbd97 100644
--- a/support/nginx/peertube
+++ b/support/nginx/peertube
@@ -37,9 +37,11 @@ server {
   # resolver $DNS-IP-1 $DNS-IP-2 valid=300s;
   # resolver_timeout 5s;
 
-  # Enable compression for JS/CSS/HTML and JSON, for improved client load times
+  # Enable compression for JS/CSS/HTML bundle, for improved client load times.
+  # It might be nice to compress JSON, but leaving that out to protect against potential
+  # compression+encryption information leak attacks like BREACH.
   gzip on;
-  gzip_types text/plain text/css text/html application/javascript application/json;
+  gzip_types text/css text/html application/javascript;
   gzip_vary on;
 
   add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";