Add documentation about breach

Author: jderusse

security/csrf.rst

@@ -162,4 +162,15 @@ to check its validity::
         }
     }
 
+CSRF tokens and compression side-channel attacks
+------------------------------------------------
+
+`BREACH`_ and `CRIME`_ are security exploits against HTTPS when using HTTP
+compression. Attacker can leverage information leaked by compression to recover
+targeted parts of the plaintext. To mitigate these attacks, and prevent an
+attacker from guessing the CSRF tokens, a random mask is prepended to the token
+and used to scramble it.
+
 .. _`Cross-site request forgery`: https://en.wikipedia.org/wiki/Cross-site_request_forgery
+.. _`BREACH``: https://en.wikipedia.org/wiki/BREACH
+.. _`CRIME``: https://en.wikipedia.org/wiki/CRIME