[nginx] Do not gzip text/vcard MIME types

Vcards contain sensitive information. It's best to disable gzip compression for them to prevent successful BREACH attacks. Ref: http://www.breachattack.com/ (cherry picked from commit 170ab9e) (cherry picked from commit 2ccc451)
debops · Dec 25, 2020 · 330bf00 · 330bf00
1 parent 522f247
commit 330bf00
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -225,6 +225,10 @@ General
 - Don't add the "always" ``add_header`` parameter into configuration files for
   :command:`nginx` < 1.7.5.
 
+- Disabled gzip compression of text/vcard MIME types. Vcards contain, by nature,
+  sensitive information and should not be gzipped to prevent successful BREACH
+  attacks.
+
 :ref:`debops.nullmailer` role
 '''''''''''''''''''''''''''''
 

diff --git a/ansible/roles/debops.nginx/defaults/main.yml b/ansible/roles/debops.nginx/defaults/main.yml
@@ -306,7 +306,6 @@ nginx_http_options: |
     text/cache-manifest
     text/css
     text/plain
-    text/vcard
     text/vnd.rim.location.xloc
     text/vtt
     text/x-component