How may web servers only serve brotli?
How many clients only accept brotli?
Well it's negotiated, right?
So say you run a SaaS that allows for something like letting people set their Avatar from an image URL which gets downloaded.
As an attacker I setup a new server that serves only brotli and then submit that URL to the SaaS.
> So say you run a SaaS that allows for something like letting people set their Avatar from an image URL which gets downloaded.
That's a clever example, but why would you do that? The avatar should be a static resource. As such, I'd only provide an upload file dialog.
Well it's negotiated, right?
So say you run a SaaS that allows for something like letting people set their Avatar from an image URL which gets downloaded.
As an attacker I setup a new server that serves only brotli and then submit that URL to the SaaS.
> So say you run a SaaS that allows for something like letting people set their Avatar from an image URL which gets downloaded.
That's a clever example, but why would you do that? The avatar should be a static resource. As such, I'd only provide an upload file dialog.