{"action":"created","comment":{"url":"https://api.github.com/repos/18F/cg-dashboard/pulls/comments/88527400","pull_request_review_id":9099214,"id":88527400,"diff_hunk":"@@ -31,6 +31,12 @@ func loadEnvVars() helpers.EnvVars {\n \tenvVars.PProfEnabled = os.Getenv(helpers.PProfEnabledEnvVar)\n \tenvVars.BuildInfo = os.Getenv(helpers.BuildInfoEnvVar)\n \tenvVars.NewRelicLicense = os.Getenv(helpers.NewRelicLicenseEnvVar)\n+\tenvVars.SecureCookies = os.Getenv(helpers.SecureCookiesEnvVar)\n+\tenvVars.SessionKey = os.Getenv(helpers.SessionKeyEnvVar)\n+\t// set a default session key if one isn't provided\n+\tif envVars.SessionKey == \"\" {","path":"server.go","position":7,"original_position":7,"commit_id":"1d16f8574a825a7cf39251f5918586fba68eb43f","original_commit_id":"1d16f8574a825a7cf39251f5918586fba68eb43f","user":{"login":"msecret","id":1701077,"avatar_url":"https://avatars.githubusercontent.com/u/1701077?v=3","gravatar_id":"","url":"https://api.github.com/users/msecret","html_url":"https://github.com/msecret","followers_url":"https://api.github.com/users/msecret/followers","following_url":"https://api.github.com/users/msecret/following{/other_user}","gists_url":"https://api.github.com/users/msecret/gists{/gist_id}","starred_url":"https://api.github.com/users/msecret/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msecret/subscriptions","organizations_url":"https://api.github.com/users/msecret/orgs","repos_url":"https://api.github.com/users/msecret/repos","events_url":"https://api.github.com/users/msecret/events{/privacy}","received_events_url":"https://api.github.com/users/msecret/received_events","type":"User","site_admin":false},"body":"`Getenv` will default to `''` if var isn't set correct?","created_at":"2016-11-17T19:27:46Z","updated_at":"2016-11-17T19:27:46Z","html_url":"https://github.com/18F/cg-dashboard/pull/733#discussion_r88527400","pull_request_url":"https://api.github.com/repos/18F/cg-dashboard/pulls/733","_links":{"self":{"href":"https://api.github.com/repos/18F/cg-dashboard/pulls/comments/88527400"},"html":{"href":"https://github.com/18F/cg-dashboard/pull/733#discussion_r88527400"},"pull_request":{"href":"https://api.github.com/repos/18F/cg-dashboard/pulls/733"}}},"pull_request":{"url":"https://api.github.com/repos/18F/cg-dashboard/pulls/733","id":94198499,"html_url":"https://github.com/18F/cg-dashboard/pull/733","diff_url":"https://github.com/18F/cg-dashboard/pull/733.diff","patch_url":"https://github.com/18F/cg-dashboard/pull/733.patch","issue_url":"https://api.github.com/repos/18F/cg-dashboard/issues/733","number":733,"state":"open","locked":false,"title":"Set HttpOnly & Secure flags on session cookies; Remove Session Key from code","user":{"login":"cnelson","id":604163,"avatar_url":"https://avatars.githubusercontent.com/u/604163?v=3","gravatar_id":"","url":"https://api.github.com/users/cnelson","html_url":"https://github.com/cnelson","followers_url":"https://api.github.com/users/cnelson/followers","following_url":"https://api.github.com/users/cnelson/following{/other_user}","gists_url":"https://api.github.com/users/cnelson/gists{/gist_id}","starred_url":"https://api.github.com/users/cnelson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cnelson/subscriptions","organizations_url":"https://api.github.com/users/cnelson/orgs","repos_url":"https://api.github.com/users/cnelson/repos","events_url":"https://api.github.com/users/cnelson/events{/privacy}","received_events_url":"https://api.github.com/users/cnelson/received_events","type":"User","site_admin":false},"body":"[FedRamp requires us](https://github.com/18F/cg-produc/issues/470) to set cookies with the [secure](https://github.com/18F/cg-product/issues/443) and [HttpOnly](https://github.com/18F/cg-product/issues/442) flags where appropriate.\r\n\r\nThis PR, sets the `HttpOnly` flag to true for all session cookies, and sets the `secure` flag to true based on the value of the `SECURE_COOKIES` environment variable.\r\n\r\nWhile I was looking at the session handling code I noticed the key for securing sessions is not stored in an environment variable, so this PR also includes a change to move that secret into the `SESSION_KEY` envvar / user-provided-service.\r\n\r\n\r\ncc: https://github.com/18F/cg-product/issues/470","created_at":"2016-11-17T16:14:05Z","updated_at":"2016-11-17T19:28:18Z","closed_at":null,"merged_at":null,"merge_commit_sha":"4c451323b489c65d68589d6c6d578261ae4acf85","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/18F/cg-dashboard/pulls/733/commits","review_comments_url":"https://api.github.com/repos/18F/cg-dashboard/pulls/733/comments","review_comment_url":"https://api.github.com/repos/18F/cg-dashboard/pulls/comments{/number}","comments_url":"https://api.github.com/repos/18F/cg-dashboard/issues/733/comments","statuses_url":"https://api.github.com/repos/18F/cg-dashboard/statuses/1d16f8574a825a7cf39251f5918586fba68eb43f","head":{"label":"18F:secure-cookies","ref":"secure-cookies","sha":"1d16f8574a825a7cf39251f5918586fba68eb43f","user":{"login":"18F","id":6233994,"avatar_url":"https://avatars.githubusercontent.com/u/6233994?v=3","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"repo":{"id":39210774,"name":"cg-dashboard","full_name":"18F/cg-dashboard","owner":{"login":"18F","id":6233994,"avatar_url":"https://avatars.githubusercontent.com/u/6233994?v=3","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/18F/cg-dashboard","description":"A web dashboard for managing Cloud Foundry Apps","fork":false,"url":"https://api.github.com/repos/18F/cg-dashboard","forks_url":"https://api.github.com/repos/18F/cg-dashboard/forks","keys_url":"https://api.github.com/repos/18F/cg-dashboard/keys{/key_id}","collaborators_url":"https://api.github.com/repos/18F/cg-dashboard/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/18F/cg-dashboard/teams","hooks_url":"https://api.github.com/repos/18F/cg-dashboard/hooks","issue_events_url":"https://api.github.com/repos/18F/cg-dashboard/issues/events{/number}","events_url":"https://api.github.com/repos/18F/cg-dashboard/events","assignees_url":"https://api.github.com/repos/18F/cg-dashboard/assignees{/user}","branches_url":"https://api.github.com/repos/18F/cg-dashboard/branches{/branch}","tags_url":"https://api.github.com/repos/18F/cg-dashboard/tags","blobs_url":"https://api.github.com/repos/18F/cg-dashboard/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/18F/cg-dashboard/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/18F/cg-dashboard/git/refs{/sha}","trees_url":"https://api.github.com/repos/18F/cg-dashboard/git/trees{/sha}","statuses_url":"https://api.github.com/repos/18F/cg-dashboard/statuses/{sha}","languages_url":"https://api.github.com/repos/18F/cg-dashboard/languages","stargazers_url":"https://api.github.com/repos/18F/cg-dashboard/stargazers","contributors_url":"https://api.github.com/repos/18F/cg-dashboard/contributors","subscribers_url":"https://api.github.com/repos/18F/cg-dashboard/subscribers","subscription_url":"https://api.github.com/repos/18F/cg-dashboard/subscription","commits_url":"https://api.github.com/repos/18F/cg-dashboard/commits{/sha}","git_commits_url":"https://api.github.com/repos/18F/cg-dashboard/git/commits{/sha}","comments_url":"https://api.github.com/repos/18F/cg-dashboard/comments{/number}","issue_comment_url":"https://api.github.com/repos/18F/cg-dashboard/issues/comments{/number}","contents_url":"https://api.github.com/repos/18F/cg-dashboard/contents/{+path}","compare_url":"https://api.github.com/repos/18F/cg-dashboard/compare/{base}...{head}","merges_url":"https://api.github.com/repos/18F/cg-dashboard/merges","archive_url":"https://api.github.com/repos/18F/cg-dashboard/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/18F/cg-dashboard/downloads","issues_url":"https://api.github.com/repos/18F/cg-dashboard/issues{/number}","pulls_url":"https://api.github.com/repos/18F/cg-dashboard/pulls{/number}","milestones_url":"https://api.github.com/repos/18F/cg-dashboard/milestones{/number}","notifications_url":"https://api.github.com/repos/18F/cg-dashboard/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/18F/cg-dashboard/labels{/name}","releases_url":"https://api.github.com/repos/18F/cg-dashboard/releases{/id}","deployments_url":"https://api.github.com/repos/18F/cg-dashboard/deployments","created_at":"2015-07-16T17:27:45Z","updated_at":"2016-11-16T05:42:08Z","pushed_at":"2016-11-17T16:42:15Z","git_url":"git://github.com/18F/cg-dashboard.git","ssh_url":"git@github.com:18F/cg-dashboard.git","clone_url":"https://github.com/18F/cg-dashboard.git","svn_url":"https://github.com/18F/cg-dashboard","homepage":"https://dashboard.cloud.gov","size":4317,"stargazers_count":9,"watchers_count":9,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":8,"mirror_url":null,"open_issues_count":84,"forks":8,"open_issues":84,"watchers":9,"default_branch":"master"}},"base":{"label":"18F:master","ref":"master","sha":"71a35d634e1d72b59cdec62a6198d9bfa7595ade","user":{"login":"18F","id":6233994,"avatar_url":"https://avatars.githubusercontent.com/u/6233994?v=3","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"repo":{"id":39210774,"name":"cg-dashboard","full_name":"18F/cg-dashboard","owner":{"login":"18F","id":6233994,"avatar_url":"https://avatars.githubusercontent.com/u/6233994?v=3","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/18F/cg-dashboard","description":"A web dashboard for managing Cloud Foundry Apps","fork":false,"url":"https://api.github.com/repos/18F/cg-dashboard","forks_url":"https://api.github.com/repos/18F/cg-dashboard/forks","keys_url":"https://api.github.com/repos/18F/cg-dashboard/keys{/key_id}","collaborators_url":"https://api.github.com/repos/18F/cg-dashboard/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/18F/cg-dashboard/teams","hooks_url":"https://api.github.com/repos/18F/cg-dashboard/hooks","issue_events_url":"https://api.github.com/repos/18F/cg-dashboard/issues/events{/number}","events_url":"https://api.github.com/repos/18F/cg-dashboard/events","assignees_url":"https://api.github.com/repos/18F/cg-dashboard/assignees{/user}","branches_url":"https://api.github.com/repos/18F/cg-dashboard/branches{/branch}","tags_url":"https://api.github.com/repos/18F/cg-dashboard/tags","blobs_url":"https://api.github.com/repos/18F/cg-dashboard/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/18F/cg-dashboard/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/18F/cg-dashboard/git/refs{/sha}","trees_url":"https://api.github.com/repos/18F/cg-dashboard/git/trees{/sha}","statuses_url":"https://api.github.com/repos/18F/cg-dashboard/statuses/{sha}","languages_url":"https://api.github.com/repos/18F/cg-dashboard/languages","stargazers_url":"https://api.github.com/repos/18F/cg-dashboard/stargazers","contributors_url":"https://api.github.com/repos/18F/cg-dashboard/contributors","subscribers_url":"https://api.github.com/repos/18F/cg-dashboard/subscribers","subscription_url":"https://api.github.com/repos/18F/cg-dashboard/subscription","commits_url":"https://api.github.com/repos/18F/cg-dashboard/commits{/sha}","git_commits_url":"https://api.github.com/repos/18F/cg-dashboard/git/commits{/sha}","comments_url":"https://api.github.com/repos/18F/cg-dashboard/comments{/number}","issue_comment_url":"https://api.github.com/repos/18F/cg-dashboard/issues/comments{/number}","contents_url":"https://api.github.com/repos/18F/cg-dashboard/contents/{+path}","compare_url":"https://api.github.com/repos/18F/cg-dashboard/compare/{base}...{head}","merges_url":"https://api.github.com/repos/18F/cg-dashboard/merges","archive_url":"https://api.github.com/repos/18F/cg-dashboard/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/18F/cg-dashboard/downloads","issues_url":"https://api.github.com/repos/18F/cg-dashboard/issues{/number}","pulls_url":"https://api.github.com/repos/18F/cg-dashboard/pulls{/number}","milestones_url":"https://api.github.com/repos/18F/cg-dashboard/milestones{/number}","notifications_url":"https://api.github.com/repos/18F/cg-dashboard/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/18F/cg-dashboard/labels{/name}","releases_url":"https://api.github.com/repos/18F/cg-dashboard/releases{/id}","deployments_url":"https://api.github.com/repos/18F/cg-dashboard/deployments","created_at":"2015-07-16T17:27:45Z","updated_at":"2016-11-16T05:42:08Z","pushed_at":"2016-11-17T16:42:15Z","git_url":"git://github.com/18F/cg-dashboard.git","ssh_url":"git@github.com:18F/cg-dashboard.git","clone_url":"https://github.com/18F/cg-dashboard.git","svn_url":"https://github.com/18F/cg-dashboard","homepage":"https://dashboard.cloud.gov","size":4317,"stargazers_count":9,"watchers_count":9,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":8,"mirror_url":null,"open_issues_count":84,"forks":8,"open_issues":84,"watchers":9,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/18F/cg-dashboard/pulls/733"},"html":{"href":"https://github.com/18F/cg-dashboard/pull/733"},"issue":{"href":"https://api.github.com/repos/18F/cg-dashboard/issues/733"},"comments":{"href":"https://api.github.com/repos/18F/cg-dashboard/issues/733/comments"},"review_comments":{"href":"https://api.github.com/repos/18F/cg-dashboard/pulls/733/comments"},"review_comment":{"href":"https://api.github.com/repos/18F/cg-dashboard/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/18F/cg-dashboard/pulls/733/commits"},"statuses":{"href":"https://api.github.com/repos/18F/cg-dashboard/statuses/1d16f8574a825a7cf39251f5918586fba68eb43f"}}}}
{"actor":{"display_login":"msecret"}}