{"action":"created","issue":{"url":"https://api.github.com/repos/khalidabuhakmeh/MvcFlash2/issues/10","labels_url":"https://api.github.com/repos/khalidabuhakmeh/MvcFlash2/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/khalidabuhakmeh/MvcFlash2/issues/10/comments","events_url":"https://api.github.com/repos/khalidabuhakmeh/MvcFlash2/issues/10/events","html_url":"https://github.com/khalidabuhakmeh/MvcFlash2/pull/10","id":48096878,"number":10,"title":"implemented Flash Messenger with HTTP Cookie storage","user":{"login":"wolfascu","id":845200,"avatar_url":"https://avatars.githubusercontent.com/u/845200?v=3","gravatar_id":"","url":"https://api.github.com/users/wolfascu","html_url":"https://github.com/wolfascu","followers_url":"https://api.github.com/users/wolfascu/followers","following_url":"https://api.github.com/users/wolfascu/following{/other_user}","gists_url":"https://api.github.com/users/wolfascu/gists{/gist_id}","starred_url":"https://api.github.com/users/wolfascu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wolfascu/subscriptions","organizations_url":"https://api.github.com/users/wolfascu/orgs","repos_url":"https://api.github.com/users/wolfascu/repos","events_url":"https://api.github.com/users/wolfascu/events{/privacy}","received_events_url":"https://api.github.com/users/wolfascu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-11-07T15:49:45Z","updated_at":"2016-01-08T09:55:48Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/khalidabuhakmeh/MvcFlash2/pulls/10","html_url":"https://github.com/khalidabuhakmeh/MvcFlash2/pull/10","diff_url":"https://github.com/khalidabuhakmeh/MvcFlash2/pull/10.diff","patch_url":"https://github.com/khalidabuhakmeh/MvcFlash2/pull/10.patch"},"body":"This pull request contains a new implementation of `IFlashMessenger` which uses HTTP Cookies as storage mechanism, as opposed to the ASP.NET Session or an in-memory dictionary.\r\n\r\nFrom the server's point of view, this can be seen as a \"stateless\" implementation of Flash messages, and could be beneficial in case a web application is hosted on more machines with no preexisting shared session state mechanism."},"comment":{"url":"https://api.github.com/repos/khalidabuhakmeh/MvcFlash2/issues/comments/169950832","html_url":"https://github.com/khalidabuhakmeh/MvcFlash2/pull/10#issuecomment-169950832","issue_url":"https://api.github.com/repos/khalidabuhakmeh/MvcFlash2/issues/10","id":169950832,"user":{"login":"wolfascu","id":845200,"avatar_url":"https://avatars.githubusercontent.com/u/845200?v=3","gravatar_id":"","url":"https://api.github.com/users/wolfascu","html_url":"https://github.com/wolfascu","followers_url":"https://api.github.com/users/wolfascu/followers","following_url":"https://api.github.com/users/wolfascu/following{/other_user}","gists_url":"https://api.github.com/users/wolfascu/gists{/gist_id}","starred_url":"https://api.github.com/users/wolfascu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wolfascu/subscriptions","organizations_url":"https://api.github.com/users/wolfascu/orgs","repos_url":"https://api.github.com/users/wolfascu/repos","events_url":"https://api.github.com/users/wolfascu/events{/privacy}","received_events_url":"https://api.github.com/users/wolfascu/received_events","type":"User","site_admin":false},"created_at":"2016-01-08T09:55:48Z","updated_at":"2016-01-08T09:55:48Z","body":"@kendaleiv Good points!\r\n\r\n* *Cookie size*: Yes, that's a real problem. In my perspective, Flash messages should be short pieces of information that you display to the user and they should generally be nowhere near the 4K limit. It would probably be a good idea to not only warn people about this limitation, but possibly also throw exceptions when the cookie exceeds a certain size.\r\n\r\n* *HTTPOnly*: Client side manipulation is a problem, but I think sending HTTPOnly cookies will not enhance security in this case. That's because the server, when presented with the Flash Cookie, will have no way of knowing whether it's a legitimate (HTTPOnly) cookie or one that's just been created by a malicious client-side script.\r\n\r\n* *Cross-domain scenarios* do not work with cookie persistence.  While it's possible to make cross domain cookies, they are not reliable (don't work in all browsers). However, this problem also exists with cookie-based sessions. Also, doing something on app1.example.com and expecting a flash message to be popped up on app2.example.com seems like an edge case to me; I don't think it's so common.\r\n\r\n* I think you're right about HTTPS; the cookie is as secure as the page is.\r\n\r\n"}}