{"action":"created","issue":{"url":"https://api.github.com/repos/asascience-open/ooi-ui-services/issues/336","repository_url":"https://api.github.com/repos/asascience-open/ooi-ui-services","labels_url":"https://api.github.com/repos/asascience-open/ooi-ui-services/issues/336/labels{/name}","comments_url":"https://api.github.com/repos/asascience-open/ooi-ui-services/issues/336/comments","events_url":"https://api.github.com/repos/asascience-open/ooi-ui-services/issues/336/events","html_url":"https://github.com/asascience-open/ooi-ui-services/issues/336","id":88187145,"number":336,"title":"Security Bug","user":{"login":"lukecampbell","id":1155163,"avatar_url":"https://avatars.githubusercontent.com/u/1155163?v=3","gravatar_id":"","url":"https://api.github.com/users/lukecampbell","html_url":"https://github.com/lukecampbell","followers_url":"https://api.github.com/users/lukecampbell/followers","following_url":"https://api.github.com/users/lukecampbell/following{/other_user}","gists_url":"https://api.github.com/users/lukecampbell/gists{/gist_id}","starred_url":"https://api.github.com/users/lukecampbell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukecampbell/subscriptions","organizations_url":"https://api.github.com/users/lukecampbell/orgs","repos_url":"https://api.github.com/users/lukecampbell/repos","events_url":"https://api.github.com/users/lukecampbell/events{/privacy}","received_events_url":"https://api.github.com/users/lukecampbell/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/asascience-open/ooi-ui-services/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-06-14T13:48:49Z","updated_at":"2016-02-16T16:36:32Z","closed_at":null,"body":"https://github.com/asascience-open/ooi-ui-services/blob/84b8fbb83e1eda8953a341c6492a3acdca70413b/ooiservices/app/models.py#L1088-L1090\r\n\r\nI played around with this, and if the application secret key is discovered or leaked then it's possible for arbitrary user escalation. If you encode the token using some secure salt then it will limit the ability for privilege escalation."},"comment":{"url":"https://api.github.com/repos/asascience-open/ooi-ui-services/issues/comments/184757593","html_url":"https://github.com/asascience-open/ooi-ui-services/issues/336#issuecomment-184757593","issue_url":"https://api.github.com/repos/asascience-open/ooi-ui-services/issues/336","id":184757593,"user":{"login":"lukecampbell","id":1155163,"avatar_url":"https://avatars.githubusercontent.com/u/1155163?v=3","gravatar_id":"","url":"https://api.github.com/users/lukecampbell","html_url":"https://github.com/lukecampbell","followers_url":"https://api.github.com/users/lukecampbell/followers","following_url":"https://api.github.com/users/lukecampbell/following{/other_user}","gists_url":"https://api.github.com/users/lukecampbell/gists{/gist_id}","starred_url":"https://api.github.com/users/lukecampbell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukecampbell/subscriptions","organizations_url":"https://api.github.com/users/lukecampbell/orgs","repos_url":"https://api.github.com/users/lukecampbell/repos","events_url":"https://api.github.com/users/lukecampbell/events{/privacy}","received_events_url":"https://api.github.com/users/lukecampbell/received_events","type":"User","site_admin":false},"created_at":"2016-02-16T16:36:32Z","updated_at":"2016-02-16T16:36:32Z","body":"Rotating the secret keys, is a start. "}}