blocking gzip encoded files

[Darwin Mecham]

It has recently come to my attention that most browsers happily
do Accept-encoding: gzip and streaming decompression of
HTML data received with Content-encoding: gzip
without asking.

This has been in use since sometime in 1998.

Is there a way to configure the run-of-the-mill browser to
block these at the host level ?

Darwin

[mgotts@2roads.com]

Darwin Mecham <darwin@cissp.com> wrote on 02/23/2004 02:38:39 PM:

> It has recently come to my attention that most browsers happily
> do Accept-encoding: gzip and streaming decompression of
> HTML data received with Content-encoding: gzip
> without asking.
>
> This has been in use since sometime in 1998.
>
> Is there a way to configure the run-of-the-mill browser to
> block these at the host level ?

I don't know of a browser setting to enable/disable it. But you can use
something like Proxomitron to do it (http://www.proxomitron.info/). The
gzip setting is one of the "Headers" settings and is called "
Accept-encoding: Allow webpage encoding (out)". Disable this to prevent
gzip encoding from being used. I've done so in the past, and it does
indeed work as advertised.

Proxomitron does *MUCH* more than this, if you are not yet familiar with
it.

-- Mark

[Josep L. Guallar-Esteve]

On Monday 23 February 2004 05:38 pm, Darwin Mecham wrote:
> It has recently come to my attention that most browsers happily
> do Accept-encoding: gzip and streaming decompression of
> HTML data received with Content-encoding: gzip
> without asking.

This is because most browsers support HTTP-1.1 standard.

http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11
http://www.w3.org/Talks/9608HTTP/
http://www.seoconsultants.com/articles/1000/http-compression.asp

> This has been in use since sometime in 1998.

IIRC, HTTP 1.1 was endorsed by W3C ~ 1999

> Is there a way to configure the run-of-the-mill browser to
> block these at the host level ?

You can disable HTTP 1.1 compliance if you wish.

> Darwin


Regards,
Josep
--
Josep L. Guallar-Esteve Eastern Radiologists, Inc.
Systems and Network Administration http://www.easternrad.com

[Gervase Markham]

Darwin Mecham wrote:
> It has recently come to my attention that most browsers happily
> do Accept-encoding: gzip and streaming decompression of
> HTML data received with Content-encoding: gzip
> without asking.
> ...
>
> Is there a way to configure the run-of-the-mill browser to
> block these at the host level ?

You can turn this off in Mozilla by changing the pref
"network.http.accept-encoding", whose default value is "gzip,deflate".

You can set this in "about:config" in recent Mozilla builds, or by
editing prefs.js or user.js in your profile using instructions available
on the web.

This has been in Mozilla since May 2001, and should therefore be
available in Netscape 7.x, Camino, Firefox et al. also.
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/netwerk/protocol/http/src/nsHttpHandler.cpp#927

Gerv