Browse files

[1.5.x] Fixed #20887 -- Added a warning to GzipMiddleware in light of…


Thanks EvilDMP for the report and Russell Keith-Magee
for the draft text.

Backport of da843e7 from master
  • Loading branch information...
1 parent 2a7d303 commit 169594f5ae09782ab1909fc3a9939a23507b4901 @timgraham timgraham committed Sep 11, 2013
Showing with 18 additions and 1 deletion.
  1. +14 −0 docs/ref/middleware.txt
  2. +4 −1 docs/topics/cache.txt
@@ -90,6 +90,20 @@ GZip middleware
.. class:: GZipMiddleware
+.. warning::
+ Security researchers recently revealed that when compression techniques
+ (including ``GZipMiddleware``) are used on a website, the site becomes
+ exposed to a number of possible attacks. These approaches can be used to
+ compromise, amongst other things, Django's CSRF protection. Before using
+ ``GZipMiddleware`` on your site, you should consider very carefully whether
+ you are subject to these attacks. If you're in *any* doubt about whether
+ you're affected, you should avoid using ``GZipMiddleware``. For more
+ details, see the `the BREACH paper (PDF)`_ and ``_.
+ .. _the BREACH paper (PDF):,%20gone%20in%2030%20seconds.pdf
+ ..
Compresses content for browsers that understand GZip compression (all modern
@@ -1147,7 +1147,10 @@ site's performance:
and ``Last-Modified`` headers.
* :class:`django.middleware.gzip.GZipMiddleware` compresses responses for all
- modern browsers, saving bandwidth and transfer time.
+ modern browsers, saving bandwidth and transfer time. Be warned, however,
+ that compression techniques like ``GZipMiddleware`` are subject to attacks.
+ See the warning in :class:`~django.middleware.gzip.GZipMiddleware` for
+ details.

0 comments on commit 169594f

Please sign in to comment.