{"action":"created","issue":{"url":"https://api.github.com/repos/Mobideck/appdeck/issues/65","repository_url":"https://api.github.com/repos/Mobideck/appdeck","labels_url":"https://api.github.com/repos/Mobideck/appdeck/issues/65/labels{/name}","comments_url":"https://api.github.com/repos/Mobideck/appdeck/issues/65/comments","events_url":"https://api.github.com/repos/Mobideck/appdeck/issues/65/events","html_url":"https://github.com/Mobideck/appdeck/issues/65","id":174919929,"number":65,"title":"Appdeck-User-ID validation service","user":{"login":"RoboKopf","id":16694201,"avatar_url":"https://avatars.githubusercontent.com/u/16694201?v=3","gravatar_id":"","url":"https://api.github.com/users/RoboKopf","html_url":"https://github.com/RoboKopf","followers_url":"https://api.github.com/users/RoboKopf/followers","following_url":"https://api.github.com/users/RoboKopf/following{/other_user}","gists_url":"https://api.github.com/users/RoboKopf/gists{/gist_id}","starred_url":"https://api.github.com/users/RoboKopf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RoboKopf/subscriptions","organizations_url":"https://api.github.com/users/RoboKopf/orgs","repos_url":"https://api.github.com/users/RoboKopf/repos","events_url":"https://api.github.com/users/RoboKopf/events{/privacy}","received_events_url":"https://api.github.com/users/RoboKopf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-09-03T21:59:52Z","updated_at":"2016-12-15T16:26:23Z","closed_at":null,"body":"I was thinking about the AppDeck-User-ID header and would like to ask a question about it and make a suggestion. First, for context, I'm going to paste in part of an email conversation I had with Mathieu about this. He wrote:\n\n\"Your app is directly connected to your server, AppDeck-User-ID header is generated on the phone via IDFA on iOS and ANDROID_ID on Android and is directly send by the phone to your server on each HTTP Request.\n\nThe header is also sent to AppDeck Cloud Services server in another independent request for Push Notification purpose.\"\n\nI do not want to serve the same page to both my app and a browser. I want to serve app pages only from within my app, and not otherwise. Here is an example of how I handle this in my .htaccess file:\n\n// Rewrite urls based on whether request is coming from inside the app:\nRewriteCond %{HTTP:Appdeck-User-Id} !=\"\"\nRewriteRule ^help.php$ /app-help.php [L]\n// If request is NOT coming from within the app, deny that the requested app-only page exists:\nRewriteCond %{HTTP:Appdeck-User-Id} =\"\"\nRewriteRule ^app-help.php$ /404.php [L]\n\nIn short, this only checks to see if the Appdeck-User-Id header has a value or not, and serves the app-only version of the help page when it does have a value (meaning that the request is coming from the app). If a request comes in for the app-only page that doesn't have the Appdeck-User-Id header set, the 404 page is served. So far so good.\n\nMy question: what is to stop someone from making a request to my server and spoofing the AppDeck-User-ID header? My server-side code would not be able to tell that this request is not coming from my app, and would serve the app-only page.\n\nIn order to prevent this, I'd like to request you to set up a RESTful appdeck user id validation service. You would allow my server to query your server with a user id, and your server would respond with a simple confirmation that the user id is valid (perhaps it could return the timestamp of the user id's first use, or null otherwise). My server could authenticate itself to your service using my app's API key/secret.\n\n(For further protection against impersonation via spoofed Appdeck-user-id header, I could set my app to run only the https version of my site, which should mean that the headers are all encrypted and that the appdeck user id could not be intercepted by a third party.)\n\nThis validation service should be easy for you to set up and would add value to your product. If I'm misunderstanding something or there are problems with the validation service idea, please let me know!\n\nAnyone else interested in something like this or have ideas about how best to achieve it?\n"},"comment":{"url":"https://api.github.com/repos/Mobideck/appdeck/issues/comments/267372151","html_url":"https://github.com/Mobideck/appdeck/issues/65#issuecomment-267372151","issue_url":"https://api.github.com/repos/Mobideck/appdeck/issues/65","id":267372151,"user":{"login":"AIMMOTH","id":5928807,"avatar_url":"https://avatars.githubusercontent.com/u/5928807?v=3","gravatar_id":"","url":"https://api.github.com/users/AIMMOTH","html_url":"https://github.com/AIMMOTH","followers_url":"https://api.github.com/users/AIMMOTH/followers","following_url":"https://api.github.com/users/AIMMOTH/following{/other_user}","gists_url":"https://api.github.com/users/AIMMOTH/gists{/gist_id}","starred_url":"https://api.github.com/users/AIMMOTH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AIMMOTH/subscriptions","organizations_url":"https://api.github.com/users/AIMMOTH/orgs","repos_url":"https://api.github.com/users/AIMMOTH/repos","events_url":"https://api.github.com/users/AIMMOTH/events{/privacy}","received_events_url":"https://api.github.com/users/AIMMOTH/received_events","type":"User","site_admin":false},"created_at":"2016-12-15T16:26:23Z","updated_at":"2016-12-15T16:26:23Z","body":"Question, I used app.helper.ajax() to POST my server in order to get the AppDeck-User-ID but there was no such header. How do I get the ID?\r\n\r\nIs there a easier way of getting the ID, like an AppDeck API call?"}}
{"actor":{"display_login":"AIMMOTH"}}