Hacker News Reader

Let’s say I have a node.js app behind an Amazon elastic load balancer which terminates TLS. My understanding is that in nearly all configurations, my app would be unaffected because the ELB would handle decompression. Is that generally correct?

View on HN

I don’t know about that specific software, but I would be surprised if it decoded message bodies, which is entirely unrelated to TLS termination and shouldd be entirely unrelated to routing. So I would expect you would still be vulnerable.

Yep, I don't think too many people are exposing their python/node servers directly, it should be always behind a proxy or a fancy cloud LB.

Apache and nginx don't handle brotli out of the box.

Your two sentences basically contradict one another, no? Apache doesn't handle brotli, so it will pass the compressed body to the underlying server undecoded, which means the underlying server is effectively exposed to attacks on this bug, if it does brotli decode on the body.

Reply on news.ycombinator.com