Btw, Cowboy also supports gzipping. You only need to pass compress: true to the server configuration (on Phoenix this means under the :http/:https keys in your configuration):

config :my_app, MyApp.Endpoint,
  http: [compress: true, ...],
  https: [compress: true, ...]

The Plug can still be handy in many situations, for example, if you cannot compress all routes, the Plug gives you flexibility where the Cowboy configuration cannot.

Plug.CSRFProtection uses a masked token which does not make it vulnerable to breach (although you need to be careful to not introduce something similar).

Thanks, I did come across this. Like you said it compressed all the traffic. Our scenario required compression of just a subset of the routes