Here's a draft for inclusion right underneath the heading introducing GZipMiddleware
.. admonition: Security researchers recently revealed that when compression techniques (including GZipMiddlware) are used on a website, a site becomes exposed to a number of possible attacks. These approaches can be used to compromise, amongst other things, Django's CSRF protection. Before using GZipMiddleware on your site, you should consider very carefully whether you are subject to these attacks. If you're in *any* doubt about whether you're affected, you should avoid using GZipMiddlware. For more details, see the [paper discussing the BREACH attack], and the [website that provides a summary of the issues involved.] Yours, Russ Magee %-) On Tue, Sep 10, 2013 at 9:24 AM, Daniele Procida <dani...@vurt.org> wrote: > On Fri, Aug 9, 2013, Daniele Procida <dani...@vurt.org> wrote: > > >What should the documents have to say on the subject now, in light of > ><https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/>? > > > ><https://code.djangoproject.com/ticket/20887> > > I'm rasising this issue again, because our documentation still suggests > using GZipMiddleware and doesn't offer any warnings; I'd submit a pull > request updating the documents, but I don't know enough about the subject > to know what it should actually say. > > Daniele > > -- > You received this message because you are subscribed to the Google Groups > "Django developers" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers. > For more options, visit https://groups.google.com/groups/opt_out. > -- You received this message because you are subscribed to the Google Groups "Django developers" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-developers+unsubscr...@googlegroups.com. To post to this group, send email to django-developers@googlegroups.com. Visit this group at http://groups.google.com/group/django-developers. For more options, visit https://groups.google.com/groups/opt_out.
