Search code examples
c#asp.netiisgzipscriptmanager

Disable gzip encoding for ASP.Net generated ScriptResource.axd

I'm trying to disable gzip encoding on both static and non-static content in an ASP.Net WebForms application. This is the suggested fix for BREACH vulnerability.

I noticed that ASP.Net/ScriptManager generated files like ScriptResource.axd are GZIP encoded by default.

This encoding is applied even if compression is disabled in IIS.

My option at this time is to write a HttpModule to remove Accepts-Encoding headers, but this doesn't seem like the right thing to do.

Solution

  • I found out that this is configured through this Web.Config setting -

    <system.web.extensions>
      <scripting>
        <scriptResourceHandler enableCompression="false" enableCaching="true" />
      </scripting>
</system.web.extensions>