romshark / datapages / 39307885889

push

github

fix: Keep streams uncompressed under no-transform

A stream compresses all its events in 1 window, so attacker text in a
later event can reveal a secret sent earlier through its size.
BREACH guidance marks such pages Cache-Control: private, no-transform,
which their streams otherwise ignore.

Require custom csrf.TokenWriters to write a new token on every call.

6 of 6 new or added lines in 1 file covered. (100.0%)

32635 of 62021 relevant lines covered (52.62%)

4441.25 hits per line