{"action":"created","issue":{"url":"https://api.github.com/repos/rails/rails/issues/24504","repository_url":"https://api.github.com/repos/rails/rails","labels_url":"https://api.github.com/repos/rails/rails/issues/24504/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/24504/comments","events_url":"https://api.github.com/repos/rails/rails/issues/24504/events","html_url":"https://github.com/rails/rails/pull/24504","id":147409988,"number":24504,"title":"Encourage best practice in the HTTP Token authentication example code","user":{"login":"nickmalcolm","id":342417,"avatar_url":"https://avatars.githubusercontent.com/u/342417?v=3","gravatar_id":"","url":"https://api.github.com/users/nickmalcolm","html_url":"https://github.com/nickmalcolm","followers_url":"https://api.github.com/users/nickmalcolm/followers","following_url":"https://api.github.com/users/nickmalcolm/following{/other_user}","gists_url":"https://api.github.com/users/nickmalcolm/gists{/gist_id}","starred_url":"https://api.github.com/users/nickmalcolm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nickmalcolm/subscriptions","organizations_url":"https://api.github.com/users/nickmalcolm/orgs","repos_url":"https://api.github.com/users/nickmalcolm/repos","events_url":"https://api.github.com/users/nickmalcolm/events{/privacy}","received_events_url":"https://api.github.com/users/nickmalcolm/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rails/rails/labels/actionpack","name":"actionpack","color":"FFF700"},{"url":"https://api.github.com/repos/rails/rails/labels/docs","name":"docs","color":"02d7e1"}],"state":"open","locked":false,"assignee":{"login":"arthurnn","id":833383,"avatar_url":"https://avatars.githubusercontent.com/u/833383?v=3","gravatar_id":"","url":"https://api.github.com/users/arthurnn","html_url":"https://github.com/arthurnn","followers_url":"https://api.github.com/users/arthurnn/followers","following_url":"https://api.github.com/users/arthurnn/following{/other_user}","gists_url":"https://api.github.com/users/arthurnn/gists{/gist_id}","starred_url":"https://api.github.com/users/arthurnn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arthurnn/subscriptions","organizations_url":"https://api.github.com/users/arthurnn/orgs","repos_url":"https://api.github.com/users/arthurnn/repos","events_url":"https://api.github.com/users/arthurnn/events{/privacy}","received_events_url":"https://api.github.com/users/arthurnn/received_events","type":"User","site_admin":true},"milestone":null,"comments":4,"created_at":"2016-04-11T12:22:48Z","updated_at":"2016-04-11T21:49:14Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rails/rails/pulls/24504","html_url":"https://github.com/rails/rails/pull/24504","diff_url":"https://github.com/rails/rails/pull/24504.diff","patch_url":"https://github.com/rails/rails/pull/24504.patch"},"body":"### Summary\r\n\r\nThis modifies the HTTP Token authentication example code. It currently uses `==` during an authentication method. This is vulnerable to timing attacks. Using something like `ActiveSupport::SecurityUtils.variable_size_secure_compare` is more secure. That method was actually introduced to mitigate a CVE in the same file, fixed in October 2015: https://github.com/rails/rails/commit/17e6f1507b7f2c2a883c180f4f9548445d6dfbda\r\n\r\nIt may seem trivial, but we should always encourage secure best practice, even if it does make the example code a bit more obtuse."},"comment":{"url":"https://api.github.com/repos/rails/rails/issues/comments/208576871","html_url":"https://github.com/rails/rails/pull/24504#issuecomment-208576871","issue_url":"https://api.github.com/repos/rails/rails/issues/24504","id":208576871,"user":{"login":"nickmalcolm","id":342417,"avatar_url":"https://avatars.githubusercontent.com/u/342417?v=3","gravatar_id":"","url":"https://api.github.com/users/nickmalcolm","html_url":"https://github.com/nickmalcolm","followers_url":"https://api.github.com/users/nickmalcolm/followers","following_url":"https://api.github.com/users/nickmalcolm/following{/other_user}","gists_url":"https://api.github.com/users/nickmalcolm/gists{/gist_id}","starred_url":"https://api.github.com/users/nickmalcolm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nickmalcolm/subscriptions","organizations_url":"https://api.github.com/users/nickmalcolm/orgs","repos_url":"https://api.github.com/users/nickmalcolm/repos","events_url":"https://api.github.com/users/nickmalcolm/events{/privacy}","received_events_url":"https://api.github.com/users/nickmalcolm/received_events","type":"User","site_admin":false},"created_at":"2016-04-11T21:49:14Z","updated_at":"2016-04-11T21:49:14Z","body":"@vipulnsward squashed :)"}}