alt Hacker NewsWell it's negotiated, right?
So say you run a SaaS that allows for something like letting people set their Avatar from an image URL which gets downloaded.
As an attacker I setup a new server that serves only brotli and then submit that URL to the SaaS.
Replies
jgalt212 • today at 1:21 PM
> So say you run a SaaS that allows for something like letting people set their Avatar from an image URL which gets downloaded.
That's a clever example, but why would you do that? The avatar should be a static resource. As such, I'd only provide an upload file dialog.
➕ show 2 replies
Just send a POST with Content-Encoding:br to any URL and hope it gets decided before the URL route is checked.