Merge branch '2.3' of ezsystems/ezplatform-http-cache into 4.6

[ezrobot]

Cross merge PR

[alongosz]

@glye you have conflicts here.

Does github now generate those commits like "Merge commit from fork"? Keep in mind that commit like this won't be visible in auto-generated changelogs. However we can merge this PR adding IBX-XXX: prefix.

[glye]

@alongosz The "Merge commit from fork" is automatic, yes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[glye]

@alongosz Manual merge done, hope I didn't 🪛 it up.

[alongosz]

@alongosz The form the merge should take is https://github.com/ibexa/http-cache-ghsa-fh7v-q458-7vmw/pull/1/files

I don't have access to it @glye (:

[glye]

@alongosz Sorry, I removed it already. But I'm pretty sure I got it right :)

[konradoboza]

I wasn't able to dig deep enough to have some further context on compression, but it feels like we are skipping it for some important content types (REST-related, JSON). I wonder if that has any repercussions on performance but I guess that wasn't checked, wasn't that? +1 to unblock release.

[glye]

Yes, there can be a performance impact, but fixing it in other ways than turning off compression is a hard problem to solve, with security pitfalls. Ref. https://www.breachattack.com/
We can discuss it after release, agree to unblock release.

[konradoboza]

At least rate-limiting looks like potential low-hanging fruit, but this still only reduces the breach probability. Thanks for the details @glye.