thruster 0.1.16-aarch64-linux → 0.1.17-aarch64-linux
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +14 -1
- data/exe/aarch64-linux/thrust +0 -0
- data/lib/thruster/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7a982990776b644651d1658a9ec2c66a5d88cbb7fe573d2d05251341c71f6fad
|
|
4
|
+
data.tar.gz: e5578657eaa2e84b9b62d5c6b40fe289bf3a09e0491279df620d9a5e597ad4b8
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: f091d1582de59f5fbbedd17d3f134573eb2aa38c3f16e4b4e74d9f56dadf982590a25dbfc52659362e3344a0a5dffa995532280f50c97468987e91c4bf1a0bc1
|
|
7
|
+
data.tar.gz: a53da10e4588b24369f588cc4e50050c56c7c9c6f19b51a4c97c902f6af3b68febd23a9e00694e8e3bca8e437a9d7023c1b5eb25cfc7678909a61bced1d84747
|
data/README.md
CHANGED
|
@@ -78,7 +78,9 @@ environment variables that you can set.
|
|
|
78
78
|
| `TARGET_PORT` | The port that your Puma server should run on. Thruster will set `PORT` to this value when starting your server. | 3000 |
|
|
79
79
|
| `CACHE_SIZE` | The size of the HTTP cache in bytes. | 64MB |
|
|
80
80
|
| `MAX_CACHE_ITEM_SIZE` | The maximum size of a single item in the HTTP cache in bytes. | 1MB |
|
|
81
|
-
| `GZIP_COMPRESSION_ENABLED` | Whether to enable gzip compression for
|
|
81
|
+
| `GZIP_COMPRESSION_ENABLED` | Whether to enable gzip compression for responses. Set to `0` or `false` to disable. | Enabled |
|
|
82
|
+
| `GZIP_COMPRESSION_DISABLE_ON_AUTH` | If set to `true`, disable gzip compression for authenticated requests with `Cookie`, `Authorization`, or `X-Csrf-Token` headers. | `false` |
|
|
83
|
+
| `GZIP_COMPRESSION_JITTER` | The amount of random jitter (in bytes) to add to the compressed response size to mitigate BREACH attacks. Set to `0` to disable. | 32 |
|
|
82
84
|
| `X_SENDFILE_ENABLED` | Whether to enable X-Sendfile support. Set to `0` or `false` to disable. | Enabled |
|
|
83
85
|
| `MAX_REQUEST_BODY` | The maximum size of a request body in bytes. Requests larger than this size will be refused; `0` means no maximum size is enforced. | `0` |
|
|
84
86
|
| `STORAGE_PATH` | The path to store Thruster's internal state. Provisioned TLS certificates will be stored here, so that they will not need to be requested every time your application is started. | `./storage/thruster` |
|
|
@@ -100,3 +102,14 @@ To prevent naming clashes with your application's own environment variables,
|
|
|
100
102
|
Thruster's environment variables can optionally be prefixed with `THRUSTER_`.
|
|
101
103
|
For example, `TLS_DOMAIN` can also be written as `THRUSTER_TLS_DOMAIN`. Whenever
|
|
102
104
|
a prefixed variable is set, it will take precedence over the unprefixed version.
|
|
105
|
+
|
|
106
|
+
## Security
|
|
107
|
+
|
|
108
|
+
### BREACH Mitigation
|
|
109
|
+
|
|
110
|
+
Thruster includes built-in mitigation for the [BREACH attack](https://breachattack.com/), which allows attackers to extract secrets from compressed encrypted traffic.
|
|
111
|
+
|
|
112
|
+
1. **Random Jitter (Enabled by Default)**: Thruster adds a random amount of "jitter" (padding) to the size of compressed responses. This makes it significantly harder for attackers to infer the content based on the compressed size. The default jitter is 32 bytes, controlled by `GZIP_COMPRESSION_JITTER`.
|
|
113
|
+
2. **Compression Guard (Optional)**: For higher security, you can disable compression entirely for authenticated requests (requests containing `Cookie`, `Authorization`, or `X-Csrf-Token` headers) by setting `GZIP_COMPRESSION_DISABLE_ON_AUTH=true`. This eliminates the side-channel entirely for sensitive traffic but may increase bandwidth usage.
|
|
114
|
+
|
|
115
|
+
By default, Thruster prioritizes performance while providing baseline protection via jitter. Operators with strict security requirements should consider enabling the Compression Guard.
|
data/exe/aarch64-linux/thrust
CHANGED
|
Binary file
|
data/lib/thruster/version.rb
CHANGED