BREACH Attack.

A 2013 side-channel attack that recovers HTTPS-protected secrets by exploiting HTTP-level compression and observing response sizes across attacker-influenced requests. It belongs to the Attacks & Threats category of cybersecurity.

A 2013 side-channel attack that recovers HTTPS-protected secrets by exploiting HTTP-level compression and observing response sizes across attacker-influenced requests.

BREACH (Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) was disclosed at Black Hat USA 2013 by Gluck, Harris, and Prado. It targets web applications that gzip-compress HTTP responses containing both attacker-controlled input and a secret such as a CSRF token. By injecting guess strings and measuring the length of encrypted responses, the attacker performs a byte-by-byte compression-ratio oracle even when TLS itself is sound. Unlike CRIME, BREACH attacks HTTP body compression, so disabling TLS compression does not mitigate it. Defences include separating secrets from compressed bodies, masking tokens per request, rate limiting, length randomization, and CSRF-token rotation.

Defences for BREACH Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: BREACH, HTTP compression side channel.