title: What parts of HTTP response are compressed using HTTP compression?
body: <p>By reading resources on the internet I got the impression that only BODY of the response is compressed because you need to read the 'Content-Encoding' header before you can decompress anything and if that was compressed, browser would not be able to decompress it.</p>
  
  <p>Later, I am reading about CRIME attack which states:</p>
  
  <blockquote>
    <p>CRIME &lt;...> is a security exploit against secret web cookies</p>
  </blockquote>
  
  <p>which implies that web cookies are also compressed, as otherwise, it would do no harm. But Cookies are sent in the headers, therefore some of the headers must be compressed.</p>
  
  <p>I would like a clear answer on what parts of the HTTP response does the HTTP compression compress. Thanks.</p>
  
  <p><strong>EDIT</strong>:
  My misunderstanding came from confusing CRIME and BREACH.</p>
  
  <p>CRIME focuses on TLS compression, which compresses headers with the body, so the cookies are included.</p>
  
  <p>BREACH focuses on HTTP level compression, which doesn't talk about Cookies :)</p>