{"action":"created","issue":{"url":"https://api.github.com/repos/k-next/kirby/issues/791","repository_url":"https://api.github.com/repos/k-next/kirby","labels_url":"https://api.github.com/repos/k-next/kirby/issues/791/labels{/name}","comments_url":"https://api.github.com/repos/k-next/kirby/issues/791/comments","events_url":"https://api.github.com/repos/k-next/kirby/issues/791/events","html_url":"https://github.com/k-next/kirby/issues/791","id":346701594,"node_id":"MDU6SXNzdWUzNDY3MDE1OTQ=","number":791,"title":"[Cms] Implement session CSRF token","user":{"login":"mzur","id":2457311,"node_id":"MDQ6VXNlcjI0NTczMTE=","avatar_url":"https://avatars2.githubusercontent.com/u/2457311?v=4","gravatar_id":"","url":"https://api.github.com/users/mzur","html_url":"https://github.com/mzur","followers_url":"https://api.github.com/users/mzur/followers","following_url":"https://api.github.com/users/mzur/following{/other_user}","gists_url":"https://api.github.com/users/mzur/gists{/gist_id}","starred_url":"https://api.github.com/users/mzur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mzur/subscriptions","organizations_url":"https://api.github.com/users/mzur/orgs","repos_url":"https://api.github.com/users/mzur/repos","events_url":"https://api.github.com/users/mzur/events{/privacy}","received_events_url":"https://api.github.com/users/mzur/received_events","type":"User","site_admin":false},"labels":[{"id":848081537,"node_id":"MDU6TGFiZWw4NDgwODE1Mzc=","url":"https://api.github.com/repos/k-next/kirby/labels/type:%20enhancement%20%E2%9C%A8","name":"type: enhancement ✨","color":"b0ecd6","default":false}],"state":"open","locked":false,"assignee":{"login":"mzur","id":2457311,"node_id":"MDQ6VXNlcjI0NTczMTE=","avatar_url":"https://avatars2.githubusercontent.com/u/2457311?v=4","gravatar_id":"","url":"https://api.github.com/users/mzur","html_url":"https://github.com/mzur","followers_url":"https://api.github.com/users/mzur/followers","following_url":"https://api.github.com/users/mzur/following{/other_user}","gists_url":"https://api.github.com/users/mzur/gists{/gist_id}","starred_url":"https://api.github.com/users/mzur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mzur/subscriptions","organizations_url":"https://api.github.com/users/mzur/orgs","repos_url":"https://api.github.com/users/mzur/repos","events_url":"https://api.github.com/users/mzur/events{/privacy}","received_events_url":"https://api.github.com/users/mzur/received_events","type":"User","site_admin":false},"assignees":[{"login":"mzur","id":2457311,"node_id":"MDQ6VXNlcjI0NTczMTE=","avatar_url":"https://avatars2.githubusercontent.com/u/2457311?v=4","gravatar_id":"","url":"https://api.github.com/users/mzur","html_url":"https://github.com/mzur","followers_url":"https://api.github.com/users/mzur/followers","following_url":"https://api.github.com/users/mzur/following{/other_user}","gists_url":"https://api.github.com/users/mzur/gists{/gist_id}","starred_url":"https://api.github.com/users/mzur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mzur/subscriptions","organizations_url":"https://api.github.com/users/mzur/orgs","repos_url":"https://api.github.com/users/mzur/repos","events_url":"https://api.github.com/users/mzur/events{/privacy}","received_events_url":"https://api.github.com/users/mzur/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2018-08-01T17:46:31Z","updated_at":"2018-08-03T06:48:10Z","closed_at":null,"author_association":"NONE","body":"As @bastianallgeier pointed out in Slack, Kirby 3 does not use a CSRF token anywhere yet. However, this is a mandatory security feature for any state changing requests, as the [same origin policy does not prevent CSRF attacks](https://stackoverflow.com/questions/33261244/why-same-origin-policy-isnt-enough-to-prevent-csrf-attacks).\r\n\r\nI intended to implement this and send a PR. But I found that there already is something called a token in the [Session](https://github.com/k-next/kirby/blob/9c20612208655c55f811fd105d79f57123e3abe2/src/Session/Session.php) class. I believe this token is the session ID, is that right? How do you want the CSRF token to be implemented then? Just choose a different name?"},"comment":{"url":"https://api.github.com/repos/k-next/kirby/issues/comments/410161392","html_url":"https://github.com/k-next/kirby/issues/791#issuecomment-410161392","issue_url":"https://api.github.com/repos/k-next/kirby/issues/791","id":410161392,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMDE2MTM5Mg==","user":{"login":"mzur","id":2457311,"node_id":"MDQ6VXNlcjI0NTczMTE=","avatar_url":"https://avatars2.githubusercontent.com/u/2457311?v=4","gravatar_id":"","url":"https://api.github.com/users/mzur","html_url":"https://github.com/mzur","followers_url":"https://api.github.com/users/mzur/followers","following_url":"https://api.github.com/users/mzur/following{/other_user}","gists_url":"https://api.github.com/users/mzur/gists{/gist_id}","starred_url":"https://api.github.com/users/mzur/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mzur/subscriptions","organizations_url":"https://api.github.com/users/mzur/orgs","repos_url":"https://api.github.com/users/mzur/repos","events_url":"https://api.github.com/users/mzur/events{/privacy}","received_events_url":"https://api.github.com/users/mzur/received_events","type":"User","site_admin":false},"created_at":"2018-08-03T06:48:10Z","updated_at":"2018-08-03T06:48:10Z","author_association":"NONE","body":"Go ahead, I won't be able to take care of this before tomorrow."}}
{"actor":{"display_login":"mzur"}}