{"action":"created","issue":{"url":"https://api.github.com/repos/FHIR/fhir.js/issues/64","repository_url":"https://api.github.com/repos/FHIR/fhir.js","labels_url":"https://api.github.com/repos/FHIR/fhir.js/issues/64/labels{/name}","comments_url":"https://api.github.com/repos/FHIR/fhir.js/issues/64/comments","events_url":"https://api.github.com/repos/FHIR/fhir.js/issues/64/events","html_url":"https://github.com/FHIR/fhir.js/issues/64","id":149745569,"number":64,"title":"Cookies behavior should be opt-in","user":{"login":"jmandel","id":313089,"avatar_url":"https://avatars.githubusercontent.com/u/313089?v=3","gravatar_id":"","url":"https://api.github.com/users/jmandel","html_url":"https://github.com/jmandel","followers_url":"https://api.github.com/users/jmandel/followers","following_url":"https://api.github.com/users/jmandel/following{/other_user}","gists_url":"https://api.github.com/users/jmandel/gists{/gist_id}","starred_url":"https://api.github.com/users/jmandel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmandel/subscriptions","organizations_url":"https://api.github.com/users/jmandel/orgs","repos_url":"https://api.github.com/users/jmandel/repos","events_url":"https://api.github.com/users/jmandel/events{/privacy}","received_events_url":"https://api.github.com/users/jmandel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-04-20T11:48:43Z","updated_at":"2016-04-20T21:20:47Z","closed_at":null,"body":"#63 adds behavior to automatically send cookies when requesting content from third party domains. I think this is potentially dangerous behavior and we should think through security more systematically. Why? Because in many cases (e.g. when using OAuth) a client doesn't want to send cookies, and sending them would lead to confusing or undefined behavior (and that's bad in the security domain).\r\n\r\nWe already have security middlewares for OAuth (for sure) and http basic (I think).\r\n\r\n@arcticShadow @niquola We should add one for cookies, too, so unless that's enabled, no cookies are sent to *any* domain. Enabling cookies should add a property to the http options (e.g. \"withCredentials: true\",   as in https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/withCredentials). \r\n\r\nTo support this, adapters will need to read that field and set the appropriate value on all  requests they issue.\r\n\r\nAlso let me say @arcticShadow: protecting a FHIR API with cookies and CORS in general strikes me as a dangerous proposition, and unless you get all the details precisely correct (https only, no JS, csrf tokens, zero xss bugs...) it's very easy to find yourself in a situation where you hand over full API access to an attacker. "},"comment":{"url":"https://api.github.com/repos/FHIR/fhir.js/issues/comments/212609836","html_url":"https://github.com/FHIR/fhir.js/issues/64#issuecomment-212609836","issue_url":"https://api.github.com/repos/FHIR/fhir.js/issues/64","id":212609836,"user":{"login":"jmandel","id":313089,"avatar_url":"https://avatars.githubusercontent.com/u/313089?v=3","gravatar_id":"","url":"https://api.github.com/users/jmandel","html_url":"https://github.com/jmandel","followers_url":"https://api.github.com/users/jmandel/followers","following_url":"https://api.github.com/users/jmandel/following{/other_user}","gists_url":"https://api.github.com/users/jmandel/gists{/gist_id}","starred_url":"https://api.github.com/users/jmandel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmandel/subscriptions","organizations_url":"https://api.github.com/users/jmandel/orgs","repos_url":"https://api.github.com/users/jmandel/repos","events_url":"https://api.github.com/users/jmandel/events{/privacy}","received_events_url":"https://api.github.com/users/jmandel/received_events","type":"User","site_admin":false},"created_at":"2016-04-20T21:20:47Z","updated_at":"2016-04-20T21:20:47Z","body":"Hmm, your \"silly\" description sounds right -- what's not working? "}}