Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? Obviously there are some finer points of the BREACH attack which I don't understand :)
I'm specifically interested in Django. In all requests for which browser sends a
csrftoken cookie, the browser also sends a
If my newfound understanding is correct, then the answer is trivially NO. The BREACH paper says:
To be vulnerable to this side-channel, a web app must: (1) Be served from a server that uses HTTP-level compression, AND (2) Reflect user-input in HTTP response bodies, AND (3) Reflect a secret (such as a CSRF token) in HTTP response bodies.
Do (2) and (3) refer to the same thing? That is, is the attack only possible if the user-input repeated in the HTTP response body is THE SAME THING as the secret you're trying to steal?
If this is correct, then it makes sense.
You can steal an CSRF token, because it's inputted by the user (generally either via a form POST param or cookie), AND it may be repeated again in the response (either as hidden input to a form, or as a cookie), AND it's the secret that you're trying to steal.
You can't steal a session token, because the user can't alter the output based on that input. I mean, sure, the user can submit an altered session cookie, but the server (hopefully) won't ever repeat that invalid session token in the response.