{"action":"created","issue":{"url":"https://api.github.com/repos/pavlov99/json-rpc/issues/42","labels_url":"https://api.github.com/repos/pavlov99/json-rpc/issues/42/labels{/name}","comments_url":"https://api.github.com/repos/pavlov99/json-rpc/issues/42/comments","events_url":"https://api.github.com/repos/pavlov99/json-rpc/issues/42/events","html_url":"https://github.com/pavlov99/json-rpc/pull/42","id":129976154,"number":42,"title":"Makes RPC endpoint CSRF exempt","user":{"login":"arnuschky","id":179920,"avatar_url":"https://avatars.githubusercontent.com/u/179920?v=3","gravatar_id":"","url":"https://api.github.com/users/arnuschky","html_url":"https://github.com/arnuschky","followers_url":"https://api.github.com/users/arnuschky/followers","following_url":"https://api.github.com/users/arnuschky/following{/other_user}","gists_url":"https://api.github.com/users/arnuschky/gists{/gist_id}","starred_url":"https://api.github.com/users/arnuschky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arnuschky/subscriptions","organizations_url":"https://api.github.com/users/arnuschky/orgs","repos_url":"https://api.github.com/users/arnuschky/repos","events_url":"https://api.github.com/users/arnuschky/events{/privacy}","received_events_url":"https://api.github.com/users/arnuschky/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"pavlov99","id":590293,"avatar_url":"https://avatars.githubusercontent.com/u/590293?v=3","gravatar_id":"","url":"https://api.github.com/users/pavlov99","html_url":"https://github.com/pavlov99","followers_url":"https://api.github.com/users/pavlov99/followers","following_url":"https://api.github.com/users/pavlov99/following{/other_user}","gists_url":"https://api.github.com/users/pavlov99/gists{/gist_id}","starred_url":"https://api.github.com/users/pavlov99/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pavlov99/subscriptions","organizations_url":"https://api.github.com/users/pavlov99/orgs","repos_url":"https://api.github.com/users/pavlov99/repos","events_url":"https://api.github.com/users/pavlov99/events{/privacy}","received_events_url":"https://api.github.com/users/pavlov99/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2016-01-30T11:32:54Z","updated_at":"2016-02-01T13:29:29Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/pavlov99/json-rpc/pulls/42","html_url":"https://github.com/pavlov99/json-rpc/pull/42","diff_url":"https://github.com/pavlov99/json-rpc/pull/42.diff","patch_url":"https://github.com/pavlov99/json-rpc/pull/42.patch"},"body":""},"comment":{"url":"https://api.github.com/repos/pavlov99/json-rpc/issues/comments/177972229","html_url":"https://github.com/pavlov99/json-rpc/pull/42#issuecomment-177972229","issue_url":"https://api.github.com/repos/pavlov99/json-rpc/issues/42","id":177972229,"user":{"login":"arnuschky","id":179920,"avatar_url":"https://avatars.githubusercontent.com/u/179920?v=3","gravatar_id":"","url":"https://api.github.com/users/arnuschky","html_url":"https://github.com/arnuschky","followers_url":"https://api.github.com/users/arnuschky/followers","following_url":"https://api.github.com/users/arnuschky/following{/other_user}","gists_url":"https://api.github.com/users/arnuschky/gists{/gist_id}","starred_url":"https://api.github.com/users/arnuschky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arnuschky/subscriptions","organizations_url":"https://api.github.com/users/arnuschky/orgs","repos_url":"https://api.github.com/users/arnuschky/repos","events_url":"https://api.github.com/users/arnuschky/events{/privacy}","received_events_url":"https://api.github.com/users/arnuschky/received_events","type":"User","site_admin":false},"created_at":"2016-02-01T13:29:29Z","updated_at":"2016-02-01T13:29:29Z","body":"I think there's a misunderstanding: my patch *disabled* CSRF protection on the API endpoint. This is commonly done for API endpoints, as there might be no GUI form that the client can get the CSRF token from. This is also why typically, token-based auth is used.\r\n\r\nI can use the subclassing, but the current behavior goes against common behavior of other API libs. I can also add a setting if desired.\r\n\r\nSorry for the tests, I can fix it if need be."}}