New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Don't compress csrf token in response #2

Open

mohe2015 opened this issue Dec 28, 2023 · 2 comments

Member

mohe2015 commented Dec 28, 2023

No description provided.

Member Author

mohe2015 commented Dec 30, 2023

Or don't make attacker controlled input part of the compression context

Member Author

mohe2015 commented Dec 30, 2023

I think if we don't allow cors requests (even not GET) we should be safe?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment