#34916: Add support for brotli compression
-----------------------------------------+------------------------
Reporter: Tom Carrick | Owner: nobody
Type: New feature | Status: new
Component: HTTP handling | Version: dev
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------+------------------------
Now that the BREACH attack is mitigated in the `GZipMiddleware` I wonder
if it's time to consider adding brotli support.
I think the best way would be to create a new `CompressionMiddleware` that
uses brotli if it's both installed and the client accepts it, otherwise
gzip if the client accepts it, and deprecate `GZipMiddleware`.
There is a third party package, [https://github.com/illagrenan/django-
brotli django-brotli] but it seems a bit unmaintained. It is out of date -
it doesn't support compressing streaming responses as the brotli Python
bindings didn't support it, but it now does. It also doesn't have any
BREACH mitigation. For mostly this reason I'd like to bring it into core
as it's a bit security sensitive and good to have first class support for
this.
--
Ticket URL: <https://code.djangoproject.com/ticket/34916>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/0107018b4caf29aa-55e8d513-8cb5-468b-9aee-d82163b317bc-000000%40eu-central-1.amazonses.com.
