{"action":"created","issue":{"url":"https://api.github.com/repos/auth0/auth0.js/issues/171","repository_url":"https://api.github.com/repos/auth0/auth0.js","labels_url":"https://api.github.com/repos/auth0/auth0.js/issues/171/labels{/name}","comments_url":"https://api.github.com/repos/auth0/auth0.js/issues/171/comments","events_url":"https://api.github.com/repos/auth0/auth0.js/issues/171/events","html_url":"https://github.com/auth0/auth0.js/issues/171","id":159913380,"number":171,"title":"getProfile doesn't validate token","user":{"login":"jniemin","id":2638877,"avatar_url":"https://avatars.githubusercontent.com/u/2638877?v=3","gravatar_id":"","url":"https://api.github.com/users/jniemin","html_url":"https://github.com/jniemin","followers_url":"https://api.github.com/users/jniemin/followers","following_url":"https://api.github.com/users/jniemin/following{/other_user}","gists_url":"https://api.github.com/users/jniemin/gists{/gist_id}","starred_url":"https://api.github.com/users/jniemin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jniemin/subscriptions","organizations_url":"https://api.github.com/users/jniemin/orgs","repos_url":"https://api.github.com/users/jniemin/repos","events_url":"https://api.github.com/users/jniemin/events{/privacy}","received_events_url":"https://api.github.com/users/jniemin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/auth0/auth0.js/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-06-13T09:57:42Z","updated_at":"2016-06-14T09:30:25Z","closed_at":"2016-06-13T13:41:10Z","body":"Document states:\r\n> The getProfile method allows you to obtain the user information after a successful login, and validates the JSON Web Token.\r\n\r\nToken is not actually validated at all. It just decodes base64 encoding and returns content. It doesn't validate if the content matches the signature.\r\n\r\nIs this something that should be changed in code or in docs to make them match? "},"comment":{"url":"https://api.github.com/repos/auth0/auth0.js/issues/comments/225828405","html_url":"https://github.com/auth0/auth0.js/issues/171#issuecomment-225828405","issue_url":"https://api.github.com/repos/auth0/auth0.js/issues/171","id":225828405,"user":{"login":"jniemin","id":2638877,"avatar_url":"https://avatars.githubusercontent.com/u/2638877?v=3","gravatar_id":"","url":"https://api.github.com/users/jniemin","html_url":"https://github.com/jniemin","followers_url":"https://api.github.com/users/jniemin/followers","following_url":"https://api.github.com/users/jniemin/following{/other_user}","gists_url":"https://api.github.com/users/jniemin/gists{/gist_id}","starred_url":"https://api.github.com/users/jniemin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jniemin/subscriptions","organizations_url":"https://api.github.com/users/jniemin/orgs","repos_url":"https://api.github.com/users/jniemin/repos","events_url":"https://api.github.com/users/jniemin/events{/privacy}","received_events_url":"https://api.github.com/users/jniemin/received_events","type":"User","site_admin":false},"created_at":"2016-06-14T09:30:25Z","updated_at":"2016-06-14T09:30:25Z","body":"This actually leaves the token vulnerable. If someone gets access to the token and is able to change it's content. `getProfile(token)` call happily returns the modified profile as the content is not verified against the signature."}}
{"actor":{"display_login":"jniemin"}}