{"action":"created","issue":{"url":"https://api.github.com/repos/contao/core-bundle/issues/558","repository_url":"https://api.github.com/repos/contao/core-bundle","labels_url":"https://api.github.com/repos/contao/core-bundle/issues/558/labels{/name}","comments_url":"https://api.github.com/repos/contao/core-bundle/issues/558/comments","events_url":"https://api.github.com/repos/contao/core-bundle/issues/558/events","html_url":"https://github.com/contao/core-bundle/pull/558","id":168932916,"number":558,"title":"[RTM] Harden authentication against session fixation","user":{"login":"discordier","id":940331,"avatar_url":"https://avatars.githubusercontent.com/u/940331?v=3","gravatar_id":"","url":"https://api.github.com/users/discordier","html_url":"https://github.com/discordier","followers_url":"https://api.github.com/users/discordier/followers","following_url":"https://api.github.com/users/discordier/following{/other_user}","gists_url":"https://api.github.com/users/discordier/gists{/gist_id}","starred_url":"https://api.github.com/users/discordier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/discordier/subscriptions","organizations_url":"https://api.github.com/users/discordier/orgs","repos_url":"https://api.github.com/users/discordier/repos","events_url":"https://api.github.com/users/discordier/events{/privacy}","received_events_url":"https://api.github.com/users/discordier/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2016-08-02T16:42:59Z","updated_at":"2016-08-04T09:24:14Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/contao/core-bundle/pulls/558","html_url":"https://github.com/contao/core-bundle/pull/558","diff_url":"https://github.com/contao/core-bundle/pull/558.diff","patch_url":"https://github.com/contao/core-bundle/pull/558.patch"},"body":"This hardens the authentication against session fixation attacks.\r\nThanks to Rico Kaltofen for pointing it out."},"comment":{"url":"https://api.github.com/repos/contao/core-bundle/issues/comments/237500524","html_url":"https://github.com/contao/core-bundle/pull/558#issuecomment-237500524","issue_url":"https://api.github.com/repos/contao/core-bundle/issues/558","id":237500524,"user":{"login":"aschempp","id":1073273,"avatar_url":"https://avatars.githubusercontent.com/u/1073273?v=3","gravatar_id":"","url":"https://api.github.com/users/aschempp","html_url":"https://github.com/aschempp","followers_url":"https://api.github.com/users/aschempp/followers","following_url":"https://api.github.com/users/aschempp/following{/other_user}","gists_url":"https://api.github.com/users/aschempp/gists{/gist_id}","starred_url":"https://api.github.com/users/aschempp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aschempp/subscriptions","organizations_url":"https://api.github.com/users/aschempp/orgs","repos_url":"https://api.github.com/users/aschempp/repos","events_url":"https://api.github.com/users/aschempp/events{/privacy}","received_events_url":"https://api.github.com/users/aschempp/received_events","type":"User","site_admin":false},"created_at":"2016-08-04T09:24:14Z","updated_at":"2016-08-04T09:24:14Z","body":"> Most session fixation attacks are web based, and most rely on session identifiers being accepted from URLs (query string) or POST data.\r\n\r\n> https://en.wikipedia.org/wiki/Session_fixation\r\n\r\nSure, but in Contao it is not possible as a remote attack (because we disallow URL session), the session is (by default) fixed to an IP address and it will time out after a few minutes. I think that already prevents a realistic scenario. Anything involving manually walking up to a computer to attack an account is highly unrealistic."}}
{"actor":{"display_login":"aschempp"}}