mirrors/django
mirrors/django
0
0
Fork 0
mirror of https://github.com/django/django.git synced 2024-11-29 14:46:18 +01:00
Code Issues Releases Wiki Activity

Fixed #20887 -- Added a warning to GzipMiddleware in light of BREACH.

Browse Source 
Thanks EvilDMP for the report and Russell Keith-Magee
for the draft text.
This commit is contained in:
Tim Graham 2013-09-11 08:17:15 -04:00
parent 5eca021d48
commit da843e7dba
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/ref/middleware.txt
View File

@ -79,6 +79,20 @@ GZip middleware
.. class:: GZipMiddleware
.. warning::
Security researchers recently revealed that when compression techniques
(including ``GZipMiddleware``) are used on a website, the site becomes
exposed to a number of possible attacks. These approaches can be used to
compromise, amongst other things, Django's CSRF protection. Before using
``GZipMiddleware`` on your site, you should consider very carefully whether
you are subject to these attacks. If you're in *any* doubt about whether
you're affected, you should avoid using ``GZipMiddleware``. For more
details, see the `the BREACH paper (PDF)`_ and `breachattack.com`_.
.. _the BREACH paper (PDF): http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%20in%2030%20seconds.pdf
.. _breachattack.com: http://breachattack.com
Compresses content for browsers that understand GZip compression (all modern
browsers).

5
docs/topics/cache.txt
View File

@ -1173,7 +1173,10 @@ site's performance:
and ``Last-Modified`` headers.
* :class:`django.middleware.gzip.GZipMiddleware` compresses responses for all
modern browsers, saving bandwidth and transfer time.
modern browsers, saving bandwidth and transfer time. Be warned, however,
that compression techniques like ``GZipMiddleware`` are subject to attacks.
See the warning in :class:`~django.middleware.gzip.GZipMiddleware` for
details.
Order of MIDDLEWARE_CLASSES
===========================