Closed Bug 1409523 Opened 8 years ago Closed 8 years ago

HTML files are not being gzipped

Categories

(developer.mozilla.org Graveyard :: Performance, enhancement, P1)

Product:
developer.mozilla.org Graveyard
Component:
Performance
Platform:
All
Other
Type:
enhancement

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: shobson, Assigned: rjohnson)

References

Details

(Keywords: in-triage, Whiteboard: [specification][type:bug])

What did you do? ================ 1. Requested a file from MDN What happened? ============== It arrived without being gzipped. What should have happened? ========================== Google recommends enabling compression and estimates we could save 72% of file size by gzipping. (https://developers.google.com/speed/pagespeed/insights/?url=developer.mozilla.org&tab=desktop) Smaller files arrive faster! Is there anything else we should know? ====================================== With 6 days of data the MDN site has been an average of 9.9% slower since the move to AWS (according to GA). Two metrics have increased: 1) page download time 2) average server response time I believe this will help address the increased page download time.
Django 1.8 is vulnerable to exposing CSRF data via BREACH when GZip is used: https://docs.djangoproject.com/en/1.8/ref/middleware/#module-django.middleware.gzip http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%20in%2030%20seconds.pdf http://breachattack.com/ This is mitigated in Django 1.10 by changing the way CSRF tokens appear in the content. A similar fix can be backported with django-debreach: https://github.com/lpomfrey/django-debreach There are not many pages where the user can easily inject content via a request. Search is one of the few, and we should disable GZip on the search page.
Severity: normal → major
Keywords: in-triage
Priority: -- → P1
See Also: → 1412891
Commits pushed to master at https://github.com/mozilla/kuma https://github.com/mozilla/kuma/commit/ff63a199786eb05a71fdc2c38aff7ec50c118ad0 bug 1409523: add django-debreach to default requirements https://github.com/mozilla/kuma/commit/f1c3e72774690d4d9507363a74f59b6c8b7de511 Merge pull request #4524 from escattone/add-debreach-1409523 bug 1409523: add django-debreach to default requirements
Commits pushed to master at https://github.com/mozilla/kuma https://github.com/mozilla/kuma/commit/6878ace4ae67e4cab9c10de4aabc217a3e98e0fe bug 1409523: add gzip compression + BREACH-attack mitigation https://github.com/mozilla/kuma/commit/26903c51f604bac41b938f7f651b681c2a20947a Merge pull request #4522 from escattone/add-gzip-1409523 bug 1409523: add gzip compression + BREACH-attack mitigation
See Also: → 1426968
John, can we close this as fixed?
Flags: needinfo?(jwhitlock)
Yes, marking as fixed
Assignee: nobody → rjohnson
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(jwhitlock)
Resolution: --- → FIXED
Product: developer.mozilla.org → developer.mozilla.org Graveyard
You need to log in before you can comment on or make changes to this bug.