{"action":"created","issue":{"url":"https://api.github.com/repos/Pylons/pyramid/issues/2501","repository_url":"https://api.github.com/repos/Pylons/pyramid","labels_url":"https://api.github.com/repos/Pylons/pyramid/issues/2501/labels{/name}","comments_url":"https://api.github.com/repos/Pylons/pyramid/issues/2501/comments","events_url":"https://api.github.com/repos/Pylons/pyramid/issues/2501/events","html_url":"https://github.com/Pylons/pyramid/pull/2501","id":148800724,"number":2501,"title":"In addition to CSRF token, verify the origin too","user":{"login":"dstufft","id":145979,"avatar_url":"https://avatars.githubusercontent.com/u/145979?v=3","gravatar_id":"","url":"https://api.github.com/users/dstufft","html_url":"https://github.com/dstufft","followers_url":"https://api.github.com/users/dstufft/followers","following_url":"https://api.github.com/users/dstufft/following{/other_user}","gists_url":"https://api.github.com/users/dstufft/gists{/gist_id}","starred_url":"https://api.github.com/users/dstufft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dstufft/subscriptions","organizations_url":"https://api.github.com/users/dstufft/orgs","repos_url":"https://api.github.com/users/dstufft/repos","events_url":"https://api.github.com/users/dstufft/events{/privacy}","received_events_url":"https://api.github.com/users/dstufft/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Pylons/pyramid/labels/merge-ready","name":"merge-ready","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/Pylons/pyramid/milestones/3","html_url":"https://github.com/Pylons/pyramid/milestones/1.7","labels_url":"https://api.github.com/repos/Pylons/pyramid/milestones/3/labels","id":1406893,"number":3,"title":"1.7","description":"","creator":{"login":"stevepiercy","id":102112,"avatar_url":"https://avatars.githubusercontent.com/u/102112?v=3","gravatar_id":"","url":"https://api.github.com/users/stevepiercy","html_url":"https://github.com/stevepiercy","followers_url":"https://api.github.com/users/stevepiercy/followers","following_url":"https://api.github.com/users/stevepiercy/following{/other_user}","gists_url":"https://api.github.com/users/stevepiercy/gists{/gist_id}","starred_url":"https://api.github.com/users/stevepiercy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevepiercy/subscriptions","organizations_url":"https://api.github.com/users/stevepiercy/orgs","repos_url":"https://api.github.com/users/stevepiercy/repos","events_url":"https://api.github.com/users/stevepiercy/events{/privacy}","received_events_url":"https://api.github.com/users/stevepiercy/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":29,"state":"open","created_at":"2015-11-11T16:26:51Z","updated_at":"2016-04-16T12:31:01Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2016-04-16T00:50:23Z","updated_at":"2016-04-16T19:13:11Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/Pylons/pyramid/pulls/2501","html_url":"https://github.com/Pylons/pyramid/pull/2501","diff_url":"https://github.com/Pylons/pyramid/pull/2501.diff","patch_url":"https://github.com/Pylons/pyramid/pull/2501.patch"},"body":"Add an additional layer of protection against CSRF by verifying the actual origin of the request in addition to the CSRF token. We only do this check on sites hosted behind HTTPS because only HTTPS sites have evidence to show that the Referrer header is not being spuriously removed by random middleware boxes.\r\n\r\nNote, to prevent any sort of backwards incompatibilities and since the CSRF predicate has been deprecated, I've only added this to the new view derivation form of CSRF.\r\n\r\nI still need to write documentation and tests (working on that now), just thought I'd throw this up here incase people were interested. This is same technique can be seen in [Django](https://github.com/django/django/blob/df8d8d4292684d6ffa7474f1e201aed486f02b53/django/middleware/csrf.py#L136-L189).\r\n"},"comment":{"url":"https://api.github.com/repos/Pylons/pyramid/issues/comments/210876291","html_url":"https://github.com/Pylons/pyramid/pull/2501#issuecomment-210876291","issue_url":"https://api.github.com/repos/Pylons/pyramid/issues/2501","id":210876291,"user":{"login":"mmerickel","id":487237,"avatar_url":"https://avatars.githubusercontent.com/u/487237?v=3","gravatar_id":"","url":"https://api.github.com/users/mmerickel","html_url":"https://github.com/mmerickel","followers_url":"https://api.github.com/users/mmerickel/followers","following_url":"https://api.github.com/users/mmerickel/following{/other_user}","gists_url":"https://api.github.com/users/mmerickel/gists{/gist_id}","starred_url":"https://api.github.com/users/mmerickel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mmerickel/subscriptions","organizations_url":"https://api.github.com/users/mmerickel/orgs","repos_url":"https://api.github.com/users/mmerickel/repos","events_url":"https://api.github.com/users/mmerickel/events{/privacy}","received_events_url":"https://api.github.com/users/mmerickel/received_events","type":"User","site_admin":false},"created_at":"2016-04-16T19:13:11Z","updated_at":"2016-04-16T19:13:11Z","body":"Not very happy about all the whitespace changes here. It made this significantly more tedious to review and github's little `?w=1` doesn't appear to be working. This type of change belongs in a separate PR."}}