News for hackers. Stuff that matters.

A comment on Security advisory: Breach and Django. Parent comment

Re:Security advisory: Breach and Django by phpnode on Tuesday August 06, 2013 @01:10PM (#6167764)
unlikely to affect you if you're already embedding CSRF tokens in your responses, which would defeat caching anyway. Curious if this response length fiddling will mitigate the attack, can anyone more knowledgeable than me confirm?
[ Parent | on HN ]
Re:Security advisory: Breach and Django by homakov on Tuesday August 06, 2013 @06:02PM (#6169520)
interesting point that CSRF tokens break caching. People can store it in cookie, and not put into the actual HTML.
[ Parent | on HN ]