Real Time Updates hard
Why might you deliberately *disable* WebSocket compression (permessage-deflate) when sending sensitive encrypted data like CSRF tokens?
- A Compression uses too much CPU.
- B It causes latency.
- C To prevent Side-Channel attacks (like CRIME/BREACH). If an attacker can inject text and observe the size of the compressed encrypted output, they can guess the secret.
- D Compression corrupts tokens.
Answer: C. To prevent Side-Channel attacks (like CRIME/BREACH). If an attacker can inject text and observe the size of the compressed encrypted output, they can guess the secret.
Compression algorithms shrink repeated patterns. If an attacker injects 'Token=A' and the packet shrinks, they know the secret starts with 'A'. This leaks data despite SSL encryption.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- When a mobile app is closed/backgrounded, it cannot keep a WebSocket open. How does it receive real-time alerts (like 'New Message')?
- For a human user, what is generally considered the maximum acceptable latency for an interaction to feel 'Real-Time' (e.g., typing in a Google Doc)?
- If you want to update a news feed on a website every time a new article is published, what is the simplest (but least efficient) 'Real-Time' technique?
- In a persistent real-time connection, what is the purpose of a 'Heartbeat' or 'Ping/Pong' message?
- Why is Short Polling considered 'Chatty'?
- Server-Sent Events (SSE) are ideal for which type of real-time application?