Browse files

Fixed #20887 -- Added a warning to GzipMiddleware in light of BREACH.

Thanks EvilDMP for the report and Russell Keith-Magee
for the draft text.
  • Loading branch information...
1 parent 5eca021 commit da843e7dba4ae8ed2846475564bb6ded82960827 @timgraham timgraham committed Sep 11, 2013
Showing with 18 additions and 1 deletion.
  1. +14 −0 docs/ref/middleware.txt
  2. +4 −1 docs/topics/cache.txt
@@ -79,6 +79,20 @@ GZip middleware
.. class:: GZipMiddleware
+.. warning::
+ Security researchers recently revealed that when compression techniques
+ (including ``GZipMiddleware``) are used on a website, the site becomes
+ exposed to a number of possible attacks. These approaches can be used to
+ compromise, amongst other things, Django's CSRF protection. Before using
+ ``GZipMiddleware`` on your site, you should consider very carefully whether
+ you are subject to these attacks. If you're in *any* doubt about whether
+ you're affected, you should avoid using ``GZipMiddleware``. For more
+ details, see the `the BREACH paper (PDF)`_ and ``_.
+ .. _the BREACH paper (PDF):,%20gone%20in%2030%20seconds.pdf
+ ..
Compresses content for browsers that understand GZip compression (all modern
@@ -1173,7 +1173,10 @@ site's performance:
and ``Last-Modified`` headers.
* :class:`django.middleware.gzip.GZipMiddleware` compresses responses for all
- modern browsers, saving bandwidth and transfer time.
+ modern browsers, saving bandwidth and transfer time. Be warned, however,
+ that compression techniques like ``GZipMiddleware`` are subject to attacks.
+ See the warning in :class:`~django.middleware.gzip.GZipMiddleware` for
+ details.

0 comments on commit da843e7

Please sign in to comment.