# Compression and length side channels

Response size or compression ratio varying with secrets, or length limits bypassed by multibyte input

_Area: Web infrastructure and server-side requests. Seen in 2 disclosed reports; one confirmed bounty: $280; latest 2019-05-21. Updated 2026-11-02._

## How it works
A response's size or compressed size is treated as harmless metadata, but it is derived from content that may be secret or sensitive. When a defender pads a response to hide its true length, or relies on a limit to bound what leaks, any later transformation that re-derives length from content (compression, localization, truncation) restores the signal. The broken assumption is that length is independent of the protected value; compression and rendering make length a function of it again.

## Where it shows up
- Intentional padding (trailing bytes, fixed-size responses) on resources that a CDN or perf change could later compress [E2](https://bugbountylibrary.com/r/h1%3A29835.md)
- GZIP/brotli enabled on padded or fixed-length resources, especially images and static assets [E2](https://bugbountylibrary.com/r/h1%3A29835.md)
- Countable oracles: a storage/rate limit where the number of accepted items reveals a hidden value [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-client-side-deanonymization-attacks-privacy-sandbox-apis.md)
- Debug or reporting channels that fire outside the page context, bypassing Referrer-Policy/CSP [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-client-side-deanonymization-attacks-privacy-sandbox-apis.md)
- Localized default UI strings (submit buttons, placeholders) whose rendered width varies by locale [E3](https://bugbountylibrary.com/r/h1%3A282748.md)
- Cross-origin worklets or scripts loaded from attacker-influenced URLs [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-client-side-deanonymization-attacks-privacy-sandbox-apis.md)

## How to review
For each response, ask: is length a function of a secret? If padding exists, confirm compression is off on that exact path and content type, and measure compressed vs uncompressed sizes. For oracles, check whether a limit is countable and whether the count is observable cross-site. For UI leaks, check whether any element geometry depends on a suppressed preference (language, locale). The invariant: observable size, count, or geometry must not vary with the protected value, and any padding must survive every transformation applied downstream.

## How finders spotted it
- Noticed junk 0x20 bytes appended to JPEG/PNG profile images, reasoned it was deliberate length-hiding padding, then later saw GZIP enabled and recognized the countermeasure was defeated [E2](https://bugbountylibrary.com/r/h1%3A29835.md)
- Browsed the MDN Web APIs index to find the Attribution Reporting API, read GitHub docs flagging a TODO about debug reports and cross-site leaks, then inspected chrome://attribution-internals to see non-existent debug destinations in real ad registrations [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-client-side-deanonymization-attacks-privacy-sandbox-apis.md)
- Deobfuscated a third-party cross-origin worklet to find Shared Storage exposure [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-client-side-deanonymization-attacks-privacy-sandbox-apis.md)
- Observed that a default submit button label is localized, and reasoned differing text lengths yield measurable width differences [E3](https://bugbountylibrary.com/r/h1%3A282748.md)

## Variants seen
- Compression defeating intentional length-hiding padding [E2](https://bugbountylibrary.com/r/h1%3A29835.md)
- Countable storage-limit oracle plus debug reports leaking source site and history [E1](https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-client-side-deanonymization-attacks-privacy-sandbox-apis.md)
- Rendered geometry of localized default strings fingerprinting locale [E3](https://bugbountylibrary.com/r/h1%3A282748.md)

## Impact and severity
E2 let a blind network attacker infer visited pages from compressed sizes, defeating a privacy countermeasure. E1 reconstructed cross-site browsing history by combining destination hijacking with a storage-limit oracle, bypassing rate limits and random report delay. E3 fingerprinted Tor Browser UI language despite the Accept-Language prompt. Impact rises when the channel is cross-site, countable, or defeats an explicit privacy control; severity tracks how much history or identity the signal reveals.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Tor**: Detecting Tor Browser UI Language. Report: https://bugbountylibrary.com/r/h1%3A282748.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-client-side-deanonymization-attacks-privacy-sandbox-apis.md
- E2: https://bugbountylibrary.com/r/h1%3A29835.md
- E3: https://bugbountylibrary.com/r/h1%3A282748.md