{"action":"created","issue":{"url":"https://api.github.com/repos/base-dev/socialite/issues/23","repository_url":"https://api.github.com/repos/base-dev/socialite","labels_url":"https://api.github.com/repos/base-dev/socialite/issues/23/labels{/name}","comments_url":"https://api.github.com/repos/base-dev/socialite/issues/23/comments","events_url":"https://api.github.com/repos/base-dev/socialite/issues/23/events","html_url":"https://github.com/base-dev/socialite/issues/23","id":167009847,"number":23,"title":"Example code in readme is maybe not correct","user":{"login":"nicolaiskogheim","id":2117636,"avatar_url":"https://avatars.githubusercontent.com/u/2117636?v=3","gravatar_id":"","url":"https://api.github.com/users/nicolaiskogheim","html_url":"https://github.com/nicolaiskogheim","followers_url":"https://api.github.com/users/nicolaiskogheim/followers","following_url":"https://api.github.com/users/nicolaiskogheim/following{/other_user}","gists_url":"https://api.github.com/users/nicolaiskogheim/gists{/gist_id}","starred_url":"https://api.github.com/users/nicolaiskogheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nicolaiskogheim/subscriptions","organizations_url":"https://api.github.com/users/nicolaiskogheim/orgs","repos_url":"https://api.github.com/users/nicolaiskogheim/repos","events_url":"https://api.github.com/users/nicolaiskogheim/events{/privacy}","received_events_url":"https://api.github.com/users/nicolaiskogheim/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-07-22T09:49:05Z","updated_at":"2016-07-25T23:53:09Z","closed_at":null,"body":"The example code in our Readme says you can run `$user->token` to get a users token, but I'm almost certain that's not right.\r\n\r\n```php\r\n$user = Socialite::driver('github')->user();\r\n\r\n// OAuth Two Providers\r\n$refreshToken = $user->refreshToken; // not always provided\r\n$expiresIn = $user->expiresIn;\r\n\r\n// OAuth One Providers\r\n$tokenSecret = $user->tokenSecret;\r\n\r\n// All Providers\r\n$token = $user->token; // <-- here\r\n$user->getId();\r\n$user->getNickname();\r\n$user->getName();\r\n$user->getEmail();\r\n$user->getAvatar();\r\n```"},"comment":{"url":"https://api.github.com/repos/base-dev/socialite/issues/comments/235121703","html_url":"https://github.com/base-dev/socialite/issues/23#issuecomment-235121703","issue_url":"https://api.github.com/repos/base-dev/socialite/issues/23","id":235121703,"user":{"login":"nicolaiskogheim","id":2117636,"avatar_url":"https://avatars.githubusercontent.com/u/2117636?v=3","gravatar_id":"","url":"https://api.github.com/users/nicolaiskogheim","html_url":"https://github.com/nicolaiskogheim","followers_url":"https://api.github.com/users/nicolaiskogheim/followers","following_url":"https://api.github.com/users/nicolaiskogheim/following{/other_user}","gists_url":"https://api.github.com/users/nicolaiskogheim/gists{/gist_id}","starred_url":"https://api.github.com/users/nicolaiskogheim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nicolaiskogheim/subscriptions","organizations_url":"https://api.github.com/users/nicolaiskogheim/orgs","repos_url":"https://api.github.com/users/nicolaiskogheim/repos","events_url":"https://api.github.com/users/nicolaiskogheim/events{/privacy}","received_events_url":"https://api.github.com/users/nicolaiskogheim/received_events","type":"User","site_admin":false},"created_at":"2016-07-25T23:53:09Z","updated_at":"2016-07-25T23:53:09Z","body":"Now that I had working code I was able to test this, and it worked, as you said.\r\n\r\nThe reason I was so sure about this being wrong was that I was unable to find any reference what so ever in the code to a user field called `token`. My guess is that every response parameter is just slapped onto the `$user` object with an `array_merge` or something. If that's the case, there may be other fields that similarly get appended too, which means we have ourselves a little security issue.\r\n\r\nI will investigate further, we need to go through every provider and sanitize all input anyway, so I'm closing this."}}
{"actor":{"display_login":"nicolaiskogheim"}}