Contributed by Jérémy Derussé in #39919.
BREACH is a security exploit against HTTPS when using HTTP compression. This kind of compression side-channel attacks are used to read some data by knowing only the size of the compressed data. Your site is at risk if attackers can read the size of your encrypted traffic and can also make any number of HTTP requests with CSRF tokens. The traditional way of mitigating this attack was to disable HTTP compression, which hurts performance significantly. Another possible solution is to ensure that CSRF tokens include some randomness, to prevent repetitive output in your responses. That’s why in Symfony 5.3 CSRF tokens are automatically randomized. This randomization process is transparent to the application, so you don’t need to configure anything and you don’t need to change your application code. If you disabled compression when using HTTPS because of this attack, upgrade to Symfony 5.3 and enable compression again to improve your site performance. This is yet another reason why using a professional framework like Symfony is better in the long run. Symfony will protect your application and your users against many common security vulnerabilities, even those you are not aware of.
Sponsor the Symfony project.Chcete-li přidat komentář, přihlaste se
Ostatní příspěvky v této skupině
This week, the upcoming Symfony 7.3 version improved the AsAlias attribute by adding a new argument, introduced Clock support for UriSigner, and refined the return type of the ContainerInterface::get(
SymfonyOnline June 2025 is almost here, starting in almost 2 months on:
June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe
SymfonyLive Paris 2025 took place three weeks ago — a big thank you to everyone who joined us! The conference was held entirely in French, and now you can relive the best moments: replays, hig
This week, Symfony 7.3 entered its "feature freeze" period in preparation for its release at the end of May 2025. Development activity focused on refining and polishing its new features, including a n
SymfonyOnline June 2025 is almost here, starting in almost 2 months on:
June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe
The international Symfony conference of the year, SymfonyCon Amsterdam 2025, will take place in the Netherlands on November 27 & 28, 2025!
⏳ Early bird registration ends this Wednesday! D
This week, the upcoming Symfony 7.3 version entered its feature freeze period to tweak and polish its new features before releasing it at the end of May 2025. In addition, we celebrated the SymfonyLiv
