{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla-services/push-dev-dashboard/issues/209","repository_url":"https://api.github.com/repos/mozilla-services/push-dev-dashboard","labels_url":"https://api.github.com/repos/mozilla-services/push-dev-dashboard/issues/209/labels{/name}","comments_url":"https://api.github.com/repos/mozilla-services/push-dev-dashboard/issues/209/comments","events_url":"https://api.github.com/repos/mozilla-services/push-dev-dashboard/issues/209/events","html_url":"https://github.com/mozilla-services/push-dev-dashboard/issues/209","id":152659544,"number":209,"title":"Add a fixed prefix to signature input","user":{"login":"martinthomson","id":67641,"avatar_url":"https://avatars.githubusercontent.com/u/67641?v=3","gravatar_id":"","url":"https://api.github.com/users/martinthomson","html_url":"https://github.com/martinthomson","followers_url":"https://api.github.com/users/martinthomson/followers","following_url":"https://api.github.com/users/martinthomson/following{/other_user}","gists_url":"https://api.github.com/users/martinthomson/gists{/gist_id}","starred_url":"https://api.github.com/users/martinthomson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinthomson/subscriptions","organizations_url":"https://api.github.com/users/martinthomson/orgs","repos_url":"https://api.github.com/users/martinthomson/repos","events_url":"https://api.github.com/users/martinthomson/events{/privacy}","received_events_url":"https://api.github.com/users/martinthomson/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla-services/push-dev-dashboard/labels/security","name":"security","color":"b60205"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2016-05-02T22:23:02Z","updated_at":"2016-05-10T04:44:38Z","closed_at":null,"body":"The challenge that a user signs with their VAPID key is a random string that is entirely under the control of the server.  If not careful, this could be used by a bad server to sign a VAPID token that the server could use to push messages to users.  To avoid this, the signature should include a fixed prefix that the signer can check before applying the signature.\r\n\r\n/cc @groovecoder"},"comment":{"url":"https://api.github.com/repos/mozilla-services/push-dev-dashboard/issues/comments/218057942","html_url":"https://github.com/mozilla-services/push-dev-dashboard/issues/209#issuecomment-218057942","issue_url":"https://api.github.com/repos/mozilla-services/push-dev-dashboard/issues/209","id":218057942,"user":{"login":"martinthomson","id":67641,"avatar_url":"https://avatars.githubusercontent.com/u/67641?v=3","gravatar_id":"","url":"https://api.github.com/users/martinthomson","html_url":"https://github.com/martinthomson","followers_url":"https://api.github.com/users/martinthomson/followers","following_url":"https://api.github.com/users/martinthomson/following{/other_user}","gists_url":"https://api.github.com/users/martinthomson/gists{/gist_id}","starred_url":"https://api.github.com/users/martinthomson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/martinthomson/subscriptions","organizations_url":"https://api.github.com/users/martinthomson/orgs","repos_url":"https://api.github.com/users/martinthomson/repos","events_url":"https://api.github.com/users/martinthomson/events{/privacy}","received_events_url":"https://api.github.com/users/martinthomson/received_events","type":"User","site_admin":false},"created_at":"2016-05-10T04:44:38Z","updated_at":"2016-05-10T04:44:38Z","body":"Actually, that's really bad.\r\n\r\nI have a better suggestion and I'm ashamed to admit that I didn't think of it earlier.  Ask for a new JWT with a different \"aud\" claim.  The server can specify what the claim should contain.  It doesn't need to be a URI, but you can use one if that makes you feel better (you should have at least 128-bits of randomness in there either way).\r\n\r\nThen you just thread this into existing code that generates tokens for use with push.  Does that work for you?"}}