Extra mitigation against the BREACH attack for Django projects.
django-debreach provides additional protection to Django’s built in CSRF token masking by randomising the content length of each response. This is achieved by adding a random string of between 12 and 25 characters as a comment to the end of the HTML content. Note that this will only be applied to responses with a content type of text/html.
When combined with the built-in mitigations in Django and rate limiting (either in your web-server, or by using something like django-ratelimit), the techniques here should provide a fairly comprehensive protection against the BREACH attack.
Installation & Usage
Install from PyPI using:
$ pip install django-debreach
To enable content length modification for all responses, add the debreach.middleware.RandomCommentMiddleware to the start of your middleware, but after the GzipMiddleware if you are using that.:
MIDDLEWARE_CLASSES = (
'debreach.middleware.RandomCommentMiddleware',
...
)
or:
MIDDLEWARE_CLASSES = (
'django.middleware.gzip.GzipMiddleware',
'debreach.middleware.RandomCommentMiddleware',
...
)
If you wish to disable this feature for selected views, simply apply the debreach.decorators.random_comment_exempt decorator to the view.
If you only want to protect a subset of views with content length modification then it may be easier to not use the middleware, but to selectively apply the debreach.decorators.append_random_comment decorator to the views you want protected.
Python 2 and Django < 2.0 support
Version 2.0.0 drops all support for Python 2 and Django < 2.0. If you need support for those versions continue using django-debreach>=1.5.2,<2.0.
1 maintainer
Metadata
1 maintainer
Release files for django-debreach 2.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| django-debreach-2.1.0.tar.gz | 15.6 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| django_debreach-2.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 23.3 kB
Release files / django-debreach-2.1.0.tar.gz
| Download URL | django-debreach-2.1.0.tar.gz |
|---|---|
| Size | 15.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
aeac9f43e0ea97830bed69cb309ad5746b5ed2b9dce733ac4c136c8e16a7d6e5
|
|
BLAKE2b-256 checksum How to use checksums |
1f1a2bc5970d6b848c7ff4ab2932493a8e25bbed47f7668e4c3338152defc01a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.7.1 importlib_metadata/4.0.1 pkginfo/1.8.2 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.60.0 CPython/3.9.7
|
Release files / django_debreach-2.1.0-py3-none-any.whl
| Download URL | django_debreach-2.1.0-py3-none-any.whl |
|---|---|
| Size | 7.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
03988a228a387ec4a2d332698ad610913d32dbcad672cf5a78842639bfeece6b
|
|
BLAKE2b-256 checksum How to use checksums |
366c8b451b1fc650f7a4336e03a5a56d555f823b6b94f1468728d650ef4d42e1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/3.7.1 importlib_metadata/4.0.1 pkginfo/1.8.2 requests/2.25.1 requests-toolbelt/0.9.1 tqdm/4.60.0 CPython/3.9.7
|
Security for django-debreach 2.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
