Comment by jgalt212
20 hours ago
> So say you run a SaaS that allows for something like letting people set their Avatar from an image URL which gets downloaded.
That's a clever example, but why would you do that? The avatar should be a static resource. As such, I'd only provide an upload file dialog.
Gravitar was super popular for a year or two.
Quit being overly pedantic about how contrived the example is and struggle with the underlying fact that the compression type is negotiated between the client and server. If the compression happens on the HTTP request (as some of the comments here suggest), then the server must use that compression method or it fails to read the body of the request.
> how contrived the example is
That's basically one of the core ingredients of security. Build a threat model.
Lots of apps will, for example, bring in your Google avatar (i.e. they fetch its URL for ingestion) as a default avatar if you use them for SSO. Slack included, IIRC.
I can almost certainly make my browser submit its file upload POST with the compression of my choice and your server will accept it.
apache does not accept brotli by default. so while the first part is true, the second part is only true for some X% of websites.