{"action":"opened","issue":{"url":"https://api.github.com/repos/HackIllinois/api-2017/issues/10","repository_url":"https://api.github.com/repos/HackIllinois/api-2017","labels_url":"https://api.github.com/repos/HackIllinois/api-2017/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/HackIllinois/api-2017/issues/10/comments","events_url":"https://api.github.com/repos/HackIllinois/api-2017/issues/10/events","html_url":"https://github.com/HackIllinois/api-2017/issues/10","id":167175179,"number":10,"title":"Role in Authentication Token","user":{"login":"nmagerko","id":3152067,"avatar_url":"https://avatars.githubusercontent.com/u/3152067?v=3","gravatar_id":"","url":"https://api.github.com/users/nmagerko","html_url":"https://github.com/nmagerko","followers_url":"https://api.github.com/users/nmagerko/followers","following_url":"https://api.github.com/users/nmagerko/following{/other_user}","gists_url":"https://api.github.com/users/nmagerko/gists{/gist_id}","starred_url":"https://api.github.com/users/nmagerko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nmagerko/subscriptions","organizations_url":"https://api.github.com/users/nmagerko/orgs","repos_url":"https://api.github.com/users/nmagerko/repos","events_url":"https://api.github.com/users/nmagerko/events{/privacy}","received_events_url":"https://api.github.com/users/nmagerko/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/HackIllinois/api-2017/labels/application","name":"application","color":"5ebeff"},{"url":"https://api.github.com/repos/HackIllinois/api-2017/labels/security","name":"security","color":"ee3f46"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/HackIllinois/api-2017/milestones/1","html_url":"https://github.com/HackIllinois/api-2017/milestones/Registration","labels_url":"https://api.github.com/repos/HackIllinois/api-2017/milestones/1/labels","id":1844583,"number":1,"title":"Registration","description":"At the moment, we are only able to create hackers by email. We also need to support the registration of these users along with the creation/registration of other types of users (administrators, staff, etc).","creator":{"login":"nmagerko","id":3152067,"avatar_url":"https://avatars.githubusercontent.com/u/3152067?v=3","gravatar_id":"","url":"https://api.github.com/users/nmagerko","html_url":"https://github.com/nmagerko","followers_url":"https://api.github.com/users/nmagerko/followers","following_url":"https://api.github.com/users/nmagerko/following{/other_user}","gists_url":"https://api.github.com/users/nmagerko/gists{/gist_id}","starred_url":"https://api.github.com/users/nmagerko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nmagerko/subscriptions","organizations_url":"https://api.github.com/users/nmagerko/orgs","repos_url":"https://api.github.com/users/nmagerko/repos","events_url":"https://api.github.com/users/nmagerko/events{/privacy}","received_events_url":"https://api.github.com/users/nmagerko/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":2,"state":"open","created_at":"2016-06-23T04:01:26Z","updated_at":"2016-07-23T08:44:06Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2016-07-23T08:44:06Z","updated_at":"2016-07-23T08:44:06Z","closed_at":null,"body":"Before we finish registration, we should address a potential security concern involving our authentication tokens. \r\n\r\nThe current authentication token holds a user's role. This is useful for the client, as it means that we do not have to make a request to get more information about a user's permissions in most cases. However, our authentication tokens cannot be expired at-will, which presents a problem.\r\n\r\nSpecifically, even if a user is demoted in role, he/she will continue to have the role that was previously signed into the authentication token until that token expires. Moreover, the server does not currently verify that the token it receives has a role that matches the persisted role, so it would be very easy to exploit this issue.\r\n\r\nTo fix this, we will remove the role from the authentication token and always query for the user presented in the token in the authentication middleware handler on the API. To ensure that we are not making more queries than we need, we will also modify the middleware to place the returned user onto the request object."}}
{"actor":{"display_login":"nmagerko"}}