{"action":"created","issue":{"url":"https://api.github.com/repos/peterkeen/payola/issues/197","labels_url":"https://api.github.com/repos/peterkeen/payola/issues/197/labels{/name}","comments_url":"https://api.github.com/repos/peterkeen/payola/issues/197/comments","events_url":"https://api.github.com/repos/peterkeen/payola/issues/197/events","html_url":"https://github.com/peterkeen/payola/issues/197","id":127207993,"number":197,"title":"Mounting Payola as a devise authenticated route?","user":{"login":"algodave","id":2955556,"avatar_url":"https://avatars.githubusercontent.com/u/2955556?v=3","gravatar_id":"","url":"https://api.github.com/users/algodave","html_url":"https://github.com/algodave","followers_url":"https://api.github.com/users/algodave/followers","following_url":"https://api.github.com/users/algodave/following{/other_user}","gists_url":"https://api.github.com/users/algodave/gists{/gist_id}","starred_url":"https://api.github.com/users/algodave/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/algodave/subscriptions","organizations_url":"https://api.github.com/users/algodave/orgs","repos_url":"https://api.github.com/users/algodave/repos","events_url":"https://api.github.com/users/algodave/events{/privacy}","received_events_url":"https://api.github.com/users/algodave/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-01-18T11:31:45Z","updated_at":"2016-01-18T16:34:10Z","closed_at":null,"body":"I'm currently mounting Payola engine as a devise authenticated route:\r\n\r\n```ruby\r\n# in routes.rb\r\nauthenticated :user do\r\n  # ... other routes ... \r\n  mount Payola::Engine => '/pay', as: :payola\r\n  # ... other routes ...\r\nend\r\n```\r\n\r\nthis way, `StripeEvent::Engine` too is mounted as an authenticated route, resulting in a 404 returned to Stripe webhook requests. The solution I've come up with so far is simply to add a `mount` line for `StripeEvent::Engine` on my app's `routes.rb` *outside* of the `authenticated` block, and configure such endpoint on Stripe settings rather than the one mounted by Payola.\r\n\r\nWhat do you think about this solution?\r\nAs an alternative, would it be safe to mount Payola outside of the `authenticated` block?"},"comment":{"url":"https://api.github.com/repos/peterkeen/payola/issues/comments/172578769","html_url":"https://github.com/peterkeen/payola/issues/197#issuecomment-172578769","issue_url":"https://api.github.com/repos/peterkeen/payola/issues/197","id":172578769,"user":{"login":"algodave","id":2955556,"avatar_url":"https://avatars.githubusercontent.com/u/2955556?v=3","gravatar_id":"","url":"https://api.github.com/users/algodave","html_url":"https://github.com/algodave","followers_url":"https://api.github.com/users/algodave/followers","following_url":"https://api.github.com/users/algodave/following{/other_user}","gists_url":"https://api.github.com/users/algodave/gists{/gist_id}","starred_url":"https://api.github.com/users/algodave/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/algodave/subscriptions","organizations_url":"https://api.github.com/users/algodave/orgs","repos_url":"https://api.github.com/users/algodave/repos","events_url":"https://api.github.com/users/algodave/events{/privacy}","received_events_url":"https://api.github.com/users/algodave/received_events","type":"User","site_admin":false},"created_at":"2016-01-18T16:34:10Z","updated_at":"2016-01-18T16:34:10Z","body":"About the following endpoints:\r\n\r\n```\r\n                     confirm GET    /confirm/:guid(.:format)                  payola/transactions#show\r\n                      status GET    /status/:guid(.:format)                   payola/transactions#status\r\n        confirm_subscription GET    /confirm_subscription/:guid(.:format)     payola/subscriptions#show\r\n         subscription_status GET    /subscription_status/:guid(.:format)      payola/subscriptions#status\r\n```\r\n\r\nif an attacker grabs in some way a subscription's guid, would he be able to read those data?"}}