23

I noticed an odd thing where apparently Firefox says it supports Brotli on HTTPS, but not HTTP? As Brotli is like gzip but more efficient, why would it limit it to HTTPS? On a HTTPS tab I see:

Accept-encoding: gzip, deflate, br

is sent. But on other site I see no br. Why can't it do Brotli compressed HTTP?

Mir-Ismaili
  • 13,974
  • 8
  • 82
  • 100
NoBugs
  • 9,310
  • 13
  • 80
  • 146

1 Answers1

21

The reason to limit brotli to secure contexts is that intermediaries (specifically, buggy proxies and content scanners) tend to behave very poorly when they encounter non-deflate/gzip Content-Encoding. The Google guys discovered this when they rolled out ‘sdch’ and ‘bzip2’ before that; they ended up pulling bzip2 partly for that reason and sdch has a number of hacks that they had to put in. By requiring HTTPS for brotli, they can head off this problem in most cases because comparatively few content-scanners MITM HTTPS streams

Taken from https://hacks.mozilla.org/2015/11/better-than-gzip-compression-with-brotli/

exussum
  • 18,275
  • 8
  • 32
  • 65