title: Mitigate BREACH attacks without saying goodbye to compression
body: <p>Everywhere I look for solutions to mitigate <a href="http://breachattack.com/" rel="noreferrer">this vulnerability</a>, I find something like:</p>
  
  <blockquote>
    <p>Just disable http compression.</p>
  </blockquote>
  
  <p>Well, that's a pain, because compression save a lot of bandwidth and also make your webpages load really faster. Moreover, what I read about BREACH, is that compression length can be used by an attacker to read some (potentially secret) information inside the compressed document.</p>
  
  <p>Now, let's admit I do have some secret information in pages I load, that doesn't mean static resources like CSS or JS have too.</p>
  
  <p>So, is it a solution to disable compression only for html pages (dynamic or not) and enable compression for non-secret resources like CSS or safe JS?</p>