I am in charge of the applicative security of our application and would like to test our exposure to the BREACH attack.
Our django-based web application reflects filtered user-input and serves a CSRF token.
The way I understand it, BREACH exploits the HTTP compression algorithm of the response body (so our session cookie would be safe in the HTTP header) to find other instances of a particular user-input string.
But what if
canary="somethingsomething" as user-input? Is the
canary part so relevant to the "guessability" of
somethingsomething? My guess this removes the canary for automatic detection, but if the rest of the page stays the same,
somethingsomething would still be vulnerable, but more difficult to identify, especially if there is more than one token in the page...