{"action":"created","issue":{"url":"https://api.github.com/repos/AlbanyCanCodeCourses/GraduatePortalFall2018/issues/20","repository_url":"https://api.github.com/repos/AlbanyCanCodeCourses/GraduatePortalFall2018","labels_url":"https://api.github.com/repos/AlbanyCanCodeCourses/GraduatePortalFall2018/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/AlbanyCanCodeCourses/GraduatePortalFall2018/issues/20/comments","events_url":"https://api.github.com/repos/AlbanyCanCodeCourses/GraduatePortalFall2018/issues/20/events","html_url":"https://github.com/AlbanyCanCodeCourses/GraduatePortalFall2018/pull/20","id":394248427,"node_id":"MDExOlB1bGxSZXF1ZXN0MjQxMDQxODMz","number":20,"title":"Login and reducer updates","user":{"login":"queensburybill","id":26352978,"node_id":"MDQ6VXNlcjI2MzUyOTc4","avatar_url":"https://avatars3.githubusercontent.com/u/26352978?v=4","gravatar_id":"","url":"https://api.github.com/users/queensburybill","html_url":"https://github.com/queensburybill","followers_url":"https://api.github.com/users/queensburybill/followers","following_url":"https://api.github.com/users/queensburybill/following{/other_user}","gists_url":"https://api.github.com/users/queensburybill/gists{/gist_id}","starred_url":"https://api.github.com/users/queensburybill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/queensburybill/subscriptions","organizations_url":"https://api.github.com/users/queensburybill/orgs","repos_url":"https://api.github.com/users/queensburybill/repos","events_url":"https://api.github.com/users/queensburybill/events{/privacy}","received_events_url":"https://api.github.com/users/queensburybill/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-12-26T22:00:48Z","updated_at":"2018-12-27T13:58:33Z","closed_at":null,"author_association":"COLLABORATOR","pull_request":{"url":"https://api.github.com/repos/AlbanyCanCodeCourses/GraduatePortalFall2018/pulls/20","html_url":"https://github.com/AlbanyCanCodeCourses/GraduatePortalFall2018/pull/20","diff_url":"https://github.com/AlbanyCanCodeCourses/GraduatePortalFall2018/pull/20.diff","patch_url":"https://github.com/AlbanyCanCodeCourses/GraduatePortalFall2018/pull/20.patch"},"body":"These updates make use of the new login endpoint created by Matina. I'm sure there are problems with the configuration, but I'm not sure how else to approach it. As it stands, a user can enter a fake token directly into localStorage in the developer tools and it will cause isAdmin to be true in the store."},"comment":{"url":"https://api.github.com/repos/AlbanyCanCodeCourses/GraduatePortalFall2018/issues/comments/450155414","html_url":"https://github.com/AlbanyCanCodeCourses/GraduatePortalFall2018/pull/20#issuecomment-450155414","issue_url":"https://api.github.com/repos/AlbanyCanCodeCourses/GraduatePortalFall2018/issues/20","id":450155414,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MDE1NTQxNA==","user":{"login":"matinaspatsos","id":6391374,"node_id":"MDQ6VXNlcjYzOTEzNzQ=","avatar_url":"https://avatars3.githubusercontent.com/u/6391374?v=4","gravatar_id":"","url":"https://api.github.com/users/matinaspatsos","html_url":"https://github.com/matinaspatsos","followers_url":"https://api.github.com/users/matinaspatsos/followers","following_url":"https://api.github.com/users/matinaspatsos/following{/other_user}","gists_url":"https://api.github.com/users/matinaspatsos/gists{/gist_id}","starred_url":"https://api.github.com/users/matinaspatsos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/matinaspatsos/subscriptions","organizations_url":"https://api.github.com/users/matinaspatsos/orgs","repos_url":"https://api.github.com/users/matinaspatsos/repos","events_url":"https://api.github.com/users/matinaspatsos/events{/privacy}","received_events_url":"https://api.github.com/users/matinaspatsos/received_events","type":"User","site_admin":false},"created_at":"2018-12-27T13:58:33Z","updated_at":"2018-12-27T13:58:33Z","author_association":"COLLABORATOR","body":"The back-end will use a \"secret\" to encode a JWT token. It will (but doesn't yet) check the token you send for every new/edit request and make sure its valid and it was generated with the secret. Sure, an attacker fake a token to get an admin view, but as long as they do not have a valid, server generated token, they will not have the power to do anything. More more information, see:\r\nhttps://medium.com/vandium-software/5-easy-steps-to-understanding-json-web-tokens-jwt-1164c0adfcec"}}
{"actor":{"display_login":"matinaspatsos"}}