{"action":"created","issue":{"url":"https://api.github.com/repos/ga4gh/server/issues/860","labels_url":"https://api.github.com/repos/ga4gh/server/issues/860/labels{/name}","comments_url":"https://api.github.com/repos/ga4gh/server/issues/860/comments","events_url":"https://api.github.com/repos/ga4gh/server/issues/860/events","html_url":"https://github.com/ga4gh/server/issues/860","id":127531833,"number":860,"title":"Padding in identifiers","user":{"login":"david4096","id":3795586,"avatar_url":"https://avatars.githubusercontent.com/u/3795586?v=3","gravatar_id":"","url":"https://api.github.com/users/david4096","html_url":"https://github.com/david4096","followers_url":"https://api.github.com/users/david4096/followers","following_url":"https://api.github.com/users/david4096/following{/other_user}","gists_url":"https://api.github.com/users/david4096/gists{/gist_id}","starred_url":"https://api.github.com/users/david4096/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david4096/subscriptions","organizations_url":"https://api.github.com/users/david4096/orgs","repos_url":"https://api.github.com/users/david4096/repos","events_url":"https://api.github.com/users/david4096/events{/privacy}","received_events_url":"https://api.github.com/users/david4096/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-01-19T20:31:54Z","updated_at":"2016-01-20T14:43:08Z","closed_at":null,"body":"There are equals signs (`=`) for padding base64 encoded identifiers that are leaked to returned identifiers. Normal practice is for `=` to encode key-value pairs in a query string. `=` is a reserved character for URL strings so our GET by ID requests look odd. \r\n\r\n     http get localhost:8000/referencesets/aGczNw%3D%3D (is the same as)\r\n     http get localhost:8000/referencesets/aGczNw==\r\n\r\nPerhaps the padding should be optional, for example, why are `YnJjYTE6SEcwMDA5Ng==`, `YnJjYTE6SEcwMDA5Ng=`, `YnJjYTE6SEcwMDA5Ng` considered three separate identifiers?\r\n\r\nA separate but perhaps related issue, there is no ceiling on the length of identifiers.\r\n\r\nhttps://www.w3.org/Addressing/URL/4_URI_Recommentations.html"},"comment":{"url":"https://api.github.com/repos/ga4gh/server/issues/comments/173224205","html_url":"https://github.com/ga4gh/server/issues/860#issuecomment-173224205","issue_url":"https://api.github.com/repos/ga4gh/server/issues/860","id":173224205,"user":{"login":"dcolligan","id":7422120,"avatar_url":"https://avatars.githubusercontent.com/u/7422120?v=3","gravatar_id":"","url":"https://api.github.com/users/dcolligan","html_url":"https://github.com/dcolligan","followers_url":"https://api.github.com/users/dcolligan/followers","following_url":"https://api.github.com/users/dcolligan/following{/other_user}","gists_url":"https://api.github.com/users/dcolligan/gists{/gist_id}","starred_url":"https://api.github.com/users/dcolligan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcolligan/subscriptions","organizations_url":"https://api.github.com/users/dcolligan/orgs","repos_url":"https://api.github.com/users/dcolligan/repos","events_url":"https://api.github.com/users/dcolligan/events{/privacy}","received_events_url":"https://api.github.com/users/dcolligan/received_events","type":"User","site_admin":false},"created_at":"2016-01-20T14:43:08Z","updated_at":"2016-01-20T14:43:08Z","body":"I vote for 1"}}