on a link. For example, the attacker may send an email to the victim saying, “See some interesting pictures!” The link actually points to a script that exploits the authentication cookies stored in the victim’s computer and sends the server several requests that involve searching in the search bar.

For example, if a victim clicks on the link when he is already authenticated to the web application, the script will use the brute-force approach and send the server several requests that will search in the search bar with texts, say from 123456 to 999999.

The attacker can now observe the length of the contents of each response, and the response with minimum compressed length will contain the victim’s credit card number.

How to prevent the BREACH attack?

Turning off HTTP compression looks like a simple solution. However, this is difficult to implement as almost all browsers rely heavily on it to manage the bandwidth and transmission speed effectively.

The other possible approaches could be :

• Protect vulnerable pages with a CSRF token. CSRF tokens ensure that a request from a browser is indeed sent by the authorized user.
• Add some random bytes to the compressed content so that all compressed web pages are of the same length.
• We can separate sensitive data of a user from the webpages where some input text is displayed.

So, beware of various vulnerabilities and stay safe and secure.