{"action":"created","issue":{"url":"https://api.github.com/repos/Yaffle/EventSource/issues/71","repository_url":"https://api.github.com/repos/Yaffle/EventSource","labels_url":"https://api.github.com/repos/Yaffle/EventSource/issues/71/labels{/name}","comments_url":"https://api.github.com/repos/Yaffle/EventSource/issues/71/comments","events_url":"https://api.github.com/repos/Yaffle/EventSource/issues/71/events","html_url":"https://github.com/Yaffle/EventSource/issues/71","id":141461965,"number":71,"title":"Origin","user":{"login":"jbarreiros","id":1109194,"avatar_url":"https://avatars.githubusercontent.com/u/1109194?v=3","gravatar_id":"","url":"https://api.github.com/users/jbarreiros","html_url":"https://github.com/jbarreiros","followers_url":"https://api.github.com/users/jbarreiros/followers","following_url":"https://api.github.com/users/jbarreiros/following{/other_user}","gists_url":"https://api.github.com/users/jbarreiros/gists{/gist_id}","starred_url":"https://api.github.com/users/jbarreiros/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbarreiros/subscriptions","organizations_url":"https://api.github.com/users/jbarreiros/orgs","repos_url":"https://api.github.com/users/jbarreiros/repos","events_url":"https://api.github.com/users/jbarreiros/events{/privacy}","received_events_url":"https://api.github.com/users/jbarreiros/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-03-17T02:37:36Z","updated_at":"2016-03-17T02:56:07Z","closed_at":null,"body":"According to http://www.html5rocks.com/en/tutorials/eventsource/basics/#toc-security, it is suggested that whenever a message arrives, `ev.orgin` should be checked to ensure the data is coming from where you expect it.\r\n\r\nWhen using the polyfill, `ev.origin` is `undefined`. Curious if there is a way to add the `origin`?\r\n\r\nI poked through the source code and the only thing I can think of is to use `window.location.origin`, but that is the origin of the document and not necessarily the server serving the EventSource connection."},"comment":{"url":"https://api.github.com/repos/Yaffle/EventSource/issues/comments/197667796","html_url":"https://github.com/Yaffle/EventSource/issues/71#issuecomment-197667796","issue_url":"https://api.github.com/repos/Yaffle/EventSource/issues/71","id":197667796,"user":{"login":"jbarreiros","id":1109194,"avatar_url":"https://avatars.githubusercontent.com/u/1109194?v=3","gravatar_id":"","url":"https://api.github.com/users/jbarreiros","html_url":"https://github.com/jbarreiros","followers_url":"https://api.github.com/users/jbarreiros/followers","following_url":"https://api.github.com/users/jbarreiros/following{/other_user}","gists_url":"https://api.github.com/users/jbarreiros/gists{/gist_id}","starred_url":"https://api.github.com/users/jbarreiros/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbarreiros/subscriptions","organizations_url":"https://api.github.com/users/jbarreiros/orgs","repos_url":"https://api.github.com/users/jbarreiros/repos","events_url":"https://api.github.com/users/jbarreiros/events{/privacy}","received_events_url":"https://api.github.com/users/jbarreiros/received_events","type":"User","site_admin":false},"created_at":"2016-03-17T02:56:06Z","updated_at":"2016-03-17T02:56:06Z","body":"Re: what's with origin? Sorry about that, I somehow hit the create issue button before entering my question."}}