{"action":"created","issue":{"url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1","repository_url":"https://api.github.com/repos/SpoonX/aurelia-authentication","labels_url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1/comments","events_url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1/events","html_url":"https://github.com/SpoonX/aurelia-authentication/issues/1","id":122939319,"number":1,"title":"Implement refresh token","user":{"login":"RWOverdijk","id":781745,"avatar_url":"https://avatars.githubusercontent.com/u/781745?v=3","gravatar_id":"","url":"https://api.github.com/users/RWOverdijk","html_url":"https://github.com/RWOverdijk","followers_url":"https://api.github.com/users/RWOverdijk/followers","following_url":"https://api.github.com/users/RWOverdijk/following{/other_user}","gists_url":"https://api.github.com/users/RWOverdijk/gists{/gist_id}","starred_url":"https://api.github.com/users/RWOverdijk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RWOverdijk/subscriptions","organizations_url":"https://api.github.com/users/RWOverdijk/orgs","repos_url":"https://api.github.com/users/RWOverdijk/repos","events_url":"https://api.github.com/users/RWOverdijk/events{/privacy}","received_events_url":"https://api.github.com/users/RWOverdijk/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2015-12-18T12:18:05Z","updated_at":"2016-06-29T11:22:07Z","closed_at":"2016-04-04T15:24:49Z","body":"https://gist.github.com/vuorinem/6b57225915e00920e3b1"},"comment":{"url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/comments/229328561","html_url":"https://github.com/SpoonX/aurelia-authentication/issues/1#issuecomment-229328561","issue_url":"https://api.github.com/repos/SpoonX/aurelia-authentication/issues/1","id":229328561,"user":{"login":"rquast","id":1103891,"avatar_url":"https://avatars.githubusercontent.com/u/1103891?v=3","gravatar_id":"","url":"https://api.github.com/users/rquast","html_url":"https://github.com/rquast","followers_url":"https://api.github.com/users/rquast/followers","following_url":"https://api.github.com/users/rquast/following{/other_user}","gists_url":"https://api.github.com/users/rquast/gists{/gist_id}","starred_url":"https://api.github.com/users/rquast/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rquast/subscriptions","organizations_url":"https://api.github.com/users/rquast/orgs","repos_url":"https://api.github.com/users/rquast/repos","events_url":"https://api.github.com/users/rquast/events{/privacy}","received_events_url":"https://api.github.com/users/rquast/received_events","type":"User","site_admin":false},"created_at":"2016-06-29T11:22:07Z","updated_at":"2016-06-29T11:22:07Z","body":"Congrats on the new feature!\r\n\r\nHowever, the use of refresh tokens with an SPA (explicit flow), is insecure. It's not only insecure on the client side, it's also insecure on the server side (the authorization code is returned a query string and gets may get logged).\r\n\r\nIt's also against the RFC - https://tools.ietf.org/html/rfc6749#section-10.5 - and the whole reason why implicit flow was created in the first place.\r\n\r\nOther than revocation of long-lived access tokens, reference tokens are one of the ways around this scenario."}}
{"actor":{"display_login":"rquast"}}