Some non-compliant clients might perhaps not like it though, not sure.
Of course, this is suboptimal compared to the client avoiding compression of sensitive parts, but I'm not sure how the server could detect that the client is fixed.
Maybe the TLS standard should be amended to add new compression algorithm identifiers that tell the server that the client knows to securely compress HTTP requests.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds