{"action":"closed","issue":{"url":"https://api.github.com/repos/mergado/mergado-apps/issues/34","repository_url":"https://api.github.com/repos/mergado/mergado-apps","labels_url":"https://api.github.com/repos/mergado/mergado-apps/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/mergado/mergado-apps/issues/34/comments","events_url":"https://api.github.com/repos/mergado/mergado-apps/issues/34/events","html_url":"https://github.com/mergado/mergado-apps/issues/34","id":192396169,"number":34,"title":"Apps have access to xenie-session cookie","user":{"login":"michalwiglasz","id":478122,"avatar_url":"https://avatars.githubusercontent.com/u/478122?v=3","gravatar_id":"","url":"https://api.github.com/users/michalwiglasz","html_url":"https://github.com/michalwiglasz","followers_url":"https://api.github.com/users/michalwiglasz/followers","following_url":"https://api.github.com/users/michalwiglasz/following{/other_user}","gists_url":"https://api.github.com/users/michalwiglasz/gists{/gist_id}","starred_url":"https://api.github.com/users/michalwiglasz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michalwiglasz/subscriptions","organizations_url":"https://api.github.com/users/michalwiglasz/orgs","repos_url":"https://api.github.com/users/michalwiglasz/repos","events_url":"https://api.github.com/users/michalwiglasz/events{/privacy}","received_events_url":"https://api.github.com/users/michalwiglasz/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-11-29T20:53:21Z","updated_at":"2016-11-30T08:23:41Z","closed_at":"2016-11-30T08:23:41Z","body":"Any request to appcloud.mergado.com sends cookie `xenie-session` containing my session ID. Malicious app can hijack user sessions.\r\n\r\nCaused by the fact that the session cookie has \"wildcarded\" domain (`domain=.mergado.com;` in `set-cookie` header). Difficult to avoid, though, because of the used subdomains (store, developers, ...)"}}
{"actor":{"display_login":"hudecsamuel"}}