1,6c1,7
< diff --git a/core/lib/Drupal/Core/HttpKernel.php b/core/lib/Drupal/Core/HttpKernel.php
< index 1f75531..ded8b60 100644
< --- a/core/lib/Drupal/Core/HttpKernel.php
< +++ b/core/lib/Drupal/Core/HttpKernel.php
< @@ -63,6 +63,12 @@ public function handle(Request $request, $type = HttpKernelInterface::MASTER_REQ
<  
---
> diff --git a/core/vendor/symfony/http-kernel/Symfony/Component/HttpKernel/HttpKernel.php b/core/vendor/symfony/http-kernel/Symfony/Component/HttpKernel/HttpKernel.php
> index 68d89c9..69429c9 100644
> --- a/core/vendor/symfony/http-kernel/Symfony/Component/HttpKernel/HttpKernel.php
> +++ b/core/vendor/symfony/http-kernel/Symfony/Component/HttpKernel/HttpKernel.php
> @@ -63,7 +63,14 @@ public function __construct(EventDispatcherInterface $dispatcher, ControllerReso
>      public function handle(Request $request, $type = HttpKernelInterface::MASTER_REQUEST, $catch = true)
>      {
8,13c9,14
<              $response = parent::handle($request, $type, $catch);
< +            // BREACH attack countermeasure: don't allow compression of HTTPS responses.
< +            if ($request->isSecure()) {
< +                if (($cacheControl = $response->headers->get('Cache-Control')) && !strstr($cacheControl, 'no-transform')) {
< +                    $response->headers->set('Cache-Control', $cacheControl . ', no-transform');
< +                }
---
> -            return $this->handleRaw($request, $type);
> +          $response = $this->handleRaw($request, $type);
> +          // BREACH attack countermeasure: don't allow compression of HTTPS responses.
> +          if ($request->isSecure()) {
> +            if (($cacheControl = $response->headers->get('Cache-Control')) && !strstr($cacheControl, 'no-transform')) {
> +              $response->headers->set('Cache-Control', $cacheControl . ', no-transform');
14a16,17
> +          }
> +          return $response;
16,17c19,20
<              $this->container->leaveScope('request');
<  
---
>              if (false === $catch) {
>                  $this->finishRequest($request, $type);