{"action":"created","issue":{"url":"https://api.github.com/repos/ptaoussanis/sente/issues/137","repository_url":"https://api.github.com/repos/ptaoussanis/sente","labels_url":"https://api.github.com/repos/ptaoussanis/sente/issues/137/labels{/name}","comments_url":"https://api.github.com/repos/ptaoussanis/sente/issues/137/comments","events_url":"https://api.github.com/repos/ptaoussanis/sente/issues/137/events","html_url":"https://github.com/ptaoussanis/sente/issues/137","id":88251987,"node_id":"MDU6SXNzdWU4ODI1MTk4Nw==","number":137,"title":"Securing cross origin requests","user":{"login":"danielcompton","id":811954,"node_id":"MDQ6VXNlcjgxMTk1NA==","avatar_url":"https://avatars2.githubusercontent.com/u/811954?v=4","gravatar_id":"","url":"https://api.github.com/users/danielcompton","html_url":"https://github.com/danielcompton","followers_url":"https://api.github.com/users/danielcompton/followers","following_url":"https://api.github.com/users/danielcompton/following{/other_user}","gists_url":"https://api.github.com/users/danielcompton/gists{/gist_id}","starred_url":"https://api.github.com/users/danielcompton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danielcompton/subscriptions","organizations_url":"https://api.github.com/users/danielcompton/orgs","repos_url":"https://api.github.com/users/danielcompton/repos","events_url":"https://api.github.com/users/danielcompton/events{/privacy}","received_events_url":"https://api.github.com/users/danielcompton/received_events","type":"User","site_admin":false},"labels":[{"id":81887758,"node_id":"MDU6TGFiZWw4MTg4Nzc1OA==","url":"https://api.github.com/repos/ptaoussanis/sente/labels/bug","name":"bug","color":"e11d21","default":true},{"id":81887761,"node_id":"MDU6TGFiZWw4MTg4Nzc2MQ==","url":"https://api.github.com/repos/ptaoussanis/sente/labels/pull%20requests%20welcome","name":"pull requests welcome","color":"009800","default":false}],"state":"open","locked":false,"assignee":{"login":"ptaoussanis","id":160011,"node_id":"MDQ6VXNlcjE2MDAxMQ==","avatar_url":"https://avatars2.githubusercontent.com/u/160011?v=4","gravatar_id":"","url":"https://api.github.com/users/ptaoussanis","html_url":"https://github.com/ptaoussanis","followers_url":"https://api.github.com/users/ptaoussanis/followers","following_url":"https://api.github.com/users/ptaoussanis/following{/other_user}","gists_url":"https://api.github.com/users/ptaoussanis/gists{/gist_id}","starred_url":"https://api.github.com/users/ptaoussanis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ptaoussanis/subscriptions","organizations_url":"https://api.github.com/users/ptaoussanis/orgs","repos_url":"https://api.github.com/users/ptaoussanis/repos","events_url":"https://api.github.com/users/ptaoussanis/events{/privacy}","received_events_url":"https://api.github.com/users/ptaoussanis/received_events","type":"User","site_admin":false},"assignees":[{"login":"ptaoussanis","id":160011,"node_id":"MDQ6VXNlcjE2MDAxMQ==","avatar_url":"https://avatars2.githubusercontent.com/u/160011?v=4","gravatar_id":"","url":"https://api.github.com/users/ptaoussanis","html_url":"https://github.com/ptaoussanis","followers_url":"https://api.github.com/users/ptaoussanis/followers","following_url":"https://api.github.com/users/ptaoussanis/following{/other_user}","gists_url":"https://api.github.com/users/ptaoussanis/gists{/gist_id}","starred_url":"https://api.github.com/users/ptaoussanis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ptaoussanis/subscriptions","organizations_url":"https://api.github.com/users/ptaoussanis/orgs","repos_url":"https://api.github.com/users/ptaoussanis/repos","events_url":"https://api.github.com/users/ptaoussanis/events{/privacy}","received_events_url":"https://api.github.com/users/ptaoussanis/received_events","type":"User","site_admin":false}],"milestone":null,"comments":13,"created_at":"2015-06-14T21:33:02Z","updated_at":"2018-12-02T12:57:33Z","closed_at":null,"author_association":"COLLABORATOR","body":"From https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html, if somebody wasn't using CSRF tokens, it seems like it would be possible for any malicious website to open up a web socket to do Bad Things. I know that CSRF tokens are highly recommended, but they're not suitable for all cases (I think). It could be good to also add CORS style protection to Sente to allow only whitelisted origins. What are your thoughts?\n\nN.B. CORS itself has no influence on websocket connections.\n"},"comment":{"url":"https://api.github.com/repos/ptaoussanis/sente/issues/comments/443505602","html_url":"https://github.com/ptaoussanis/sente/issues/137#issuecomment-443505602","issue_url":"https://api.github.com/repos/ptaoussanis/sente/issues/137","id":443505602,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MzUwNTYwMg==","user":{"login":"ptaoussanis","id":160011,"node_id":"MDQ6VXNlcjE2MDAxMQ==","avatar_url":"https://avatars2.githubusercontent.com/u/160011?v=4","gravatar_id":"","url":"https://api.github.com/users/ptaoussanis","html_url":"https://github.com/ptaoussanis","followers_url":"https://api.github.com/users/ptaoussanis/followers","following_url":"https://api.github.com/users/ptaoussanis/following{/other_user}","gists_url":"https://api.github.com/users/ptaoussanis/gists{/gist_id}","starred_url":"https://api.github.com/users/ptaoussanis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ptaoussanis/subscriptions","organizations_url":"https://api.github.com/users/ptaoussanis/orgs","repos_url":"https://api.github.com/users/ptaoussanis/repos","events_url":"https://api.github.com/users/ptaoussanis/events{/privacy}","received_events_url":"https://api.github.com/users/ptaoussanis/received_events","type":"User","site_admin":false},"created_at":"2018-12-02T12:57:33Z","updated_at":"2018-12-02T12:57:33Z","author_association":"OWNER","body":"Have pushed `[com.taoensso/sente \"1.14.0-RC1\"]` to Clojars for testing, adding also constant-time equality checking on the CSRF token to help prevent possible timing attacks.\r\n\r\nIf there's no issues with this release, will document further and release as `v1.14.0`."}}
{"actor":{"display_login":"ptaoussanis"}}