BREACH is a security exploit against HTTPS when using HTTP compression. This
kind of compression side-channel attacks are used to read some data by knowing
only the size of the compressed data.

Your site is at risk if attackers can read the size of your encrypted traffic
and can also make any number of HTTP requests with CSRF tokens. The traditional
way of mitigating this attack was to disable HTTP compression, which hurts
performance significantly.

Another possible solution is to ensure that CSRF tokens include some randomness,
to prevent repetitive output in your responses. That’s why in Symfony 5.3
CSRF tokens are automatically randomized.

This randomization process is transparent to the application, so you don’t need
to configure anything and you don’t need to change your application code. If
you disabled compression when using HTTPS because of this attack, upgrade to
Symfony 5.3 and enable compression again to improve your site performance.

This is yet another reason why using a professional framework like Symfony is
better in the long run. Symfony will protect your application and your users
against many common security vulnerabilities, even those you are not aware of.

Symfony Blog
Read More