Skip to content

Commit b965f73

Browse files
committed
document async gzip middleware
1 parent 3b05fc0 commit b965f73

File tree

1 file changed

+20
-0
lines changed

1 file changed

+20
-0
lines changed

docs/middleware/gzip_middleware.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# AsyncGZipMiddleware
2+
3+
it works exactly like django's [GZipMiddleware](https://docs.djangoproject.com/en/5.1/ref/middleware/#module-django.middleware.gzip)
4+
except that it's fully async
5+
6+
------------------------
7+
**important:**
8+
Security researchers revealed that when compression techniques (including GZipMiddleware) are used on a website, the site may become exposed to a number of possible attacks.
9+
10+
To mitigate attacks, Django implements a technique called Heal The Breach (HTB). It adds up to 100 bytes (see [max_random_bytes](https://docs.djangoproject.com/en/5.1/ref/middleware/#django.middleware.gzip.GZipMiddleware.max_random_bytes)) of random bytes to each response to make the attacks less effective.
11+
12+
For more details, see the [BREACH paper (PDF)](https://www.breachattack.com/resources/BREACH%20-%20SSL,%20gone%20in%2030%20seconds.pdf), [breachattack.com](https://www.breachattack.com/), and the [Heal The Breach (HTB) paper](https://ieeexplore.ieee.org/document/9754554).
13+
14+
-------------------------
15+
16+
### Usage:
17+
remove django's `django.middleware.gzip.GZipMiddleware` from the `MIDDLEWARE` setting (if it's in there) and add
18+
`django_async_extensions.middleware.gzip.AsyncGZipMiddleware` in it's place.
19+
20+
**note**: this middleware like other middlewares provided in this package can work alongside sync middlewares, and can handle sync views.

0 commit comments

Comments
 (0)