mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-04 19:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed #20887 -- Added a warning to GzipMiddleware in light of BREACH.

Browse source 
Thanks EvilDMP for the report and Russell Keith-Magee
for the draft text.
This commit is contained in:
Tim Graham 2013-09-11 08:17:15 -04:00
parent 5eca021d48
commit da843e7dba
2 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/ref/middleware.txt
View file

@ -79,6 +79,20 @@ GZip middleware
.. class:: GZipMiddleware
.. warning::
Security researchers recently revealed that when compression techniques
(including ``GZipMiddleware``) are used on a website, the site becomes
exposed to a number of possible attacks. These approaches can be used to
compromise, amongst other things, Django's CSRF protection. Before using
``GZipMiddleware`` on your site, you should consider very carefully whether
you are subject to these attacks. If you're in *any* doubt about whether
you're affected, you should avoid using ``GZipMiddleware``. For more
details, see the `the BREACH paper (PDF)`_ and `breachattack.com`_.
.. _the BREACH paper (PDF): http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%20in%2030%20seconds.pdf
.. _breachattack.com: http://breachattack.com
Compresses content for browsers that understand GZip compression (all modern
browsers).