{"action":"created","issue":{"url":"https://api.github.com/repos/brainblocks/brainblocks/issues/74","repository_url":"https://api.github.com/repos/brainblocks/brainblocks","labels_url":"https://api.github.com/repos/brainblocks/brainblocks/issues/74/labels{/name}","comments_url":"https://api.github.com/repos/brainblocks/brainblocks/issues/74/comments","events_url":"https://api.github.com/repos/brainblocks/brainblocks/issues/74/events","html_url":"https://github.com/brainblocks/brainblocks/issues/74","id":367022237,"node_id":"MDU6SXNzdWUzNjcwMjIyMzc=","number":74,"title":"Token security weakness","user":{"login":"timint","id":359192,"node_id":"MDQ6VXNlcjM1OTE5Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/359192?v=4","gravatar_id":"","url":"https://api.github.com/users/timint","html_url":"https://github.com/timint","followers_url":"https://api.github.com/users/timint/followers","following_url":"https://api.github.com/users/timint/following{/other_user}","gists_url":"https://api.github.com/users/timint/gists{/gist_id}","starred_url":"https://api.github.com/users/timint/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timint/subscriptions","organizations_url":"https://api.github.com/users/timint/orgs","repos_url":"https://api.github.com/users/timint/repos","events_url":"https://api.github.com/users/timint/events{/privacy}","received_events_url":"https://api.github.com/users/timint/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"bluepnume","id":1219075,"node_id":"MDQ6VXNlcjEyMTkwNzU=","avatar_url":"https://avatars2.githubusercontent.com/u/1219075?v=4","gravatar_id":"","url":"https://api.github.com/users/bluepnume","html_url":"https://github.com/bluepnume","followers_url":"https://api.github.com/users/bluepnume/followers","following_url":"https://api.github.com/users/bluepnume/following{/other_user}","gists_url":"https://api.github.com/users/bluepnume/gists{/gist_id}","starred_url":"https://api.github.com/users/bluepnume/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bluepnume/subscriptions","organizations_url":"https://api.github.com/users/bluepnume/orgs","repos_url":"https://api.github.com/users/bluepnume/repos","events_url":"https://api.github.com/users/bluepnume/events{/privacy}","received_events_url":"https://api.github.com/users/bluepnume/received_events","type":"User","site_admin":false},"assignees":[{"login":"bluepnume","id":1219075,"node_id":"MDQ6VXNlcjEyMTkwNzU=","avatar_url":"https://avatars2.githubusercontent.com/u/1219075?v=4","gravatar_id":"","url":"https://api.github.com/users/bluepnume","html_url":"https://github.com/bluepnume","followers_url":"https://api.github.com/users/bluepnume/followers","following_url":"https://api.github.com/users/bluepnume/following{/other_user}","gists_url":"https://api.github.com/users/bluepnume/gists{/gist_id}","starred_url":"https://api.github.com/users/bluepnume/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bluepnume/subscriptions","organizations_url":"https://api.github.com/users/bluepnume/orgs","repos_url":"https://api.github.com/users/bluepnume/repos","events_url":"https://api.github.com/users/bluepnume/events{/privacy}","received_events_url":"https://api.github.com/users/bluepnume/received_events","type":"User","site_admin":false},{"login":"schenkty","id":7807169,"node_id":"MDQ6VXNlcjc4MDcxNjk=","avatar_url":"https://avatars1.githubusercontent.com/u/7807169?v=4","gravatar_id":"","url":"https://api.github.com/users/schenkty","html_url":"https://github.com/schenkty","followers_url":"https://api.github.com/users/schenkty/followers","following_url":"https://api.github.com/users/schenkty/following{/other_user}","gists_url":"https://api.github.com/users/schenkty/gists{/gist_id}","starred_url":"https://api.github.com/users/schenkty/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schenkty/subscriptions","organizations_url":"https://api.github.com/users/schenkty/orgs","repos_url":"https://api.github.com/users/schenkty/repos","events_url":"https://api.github.com/users/schenkty/events{/privacy}","received_events_url":"https://api.github.com/users/schenkty/received_events","type":"User","site_admin":false}],"milestone":null,"comments":5,"created_at":"2018-10-05T00:58:30Z","updated_at":"2018-10-12T14:39:52Z","closed_at":null,"author_association":"NONE","body":"Hey guys. Nice work on the brainblocks api. I love the simplicity.\r\n\r\nI would like to question the security a bit when it comes to verifying.\r\n\r\nAs the token is carried back to the store through the paying customer's web browser it could easily be exchanged with say an old token giving the exact same amount. The store would successfully validate the transaction and process the order.\r\n\r\nWhat I am lacking is a trusted (machine-to-machine) call to prepare the button or checkout window for the client.\r\n\r\n1. Setup button with machine to machine call. Receives token.\r\n2. Sets up button with token for client.\r\n3. Client pays.\r\n4. Client returns, we already possess the token from step 1. and can easily verify it.\r\n"},"comment":{"url":"https://api.github.com/repos/brainblocks/brainblocks/issues/comments/429348812","html_url":"https://github.com/brainblocks/brainblocks/issues/74#issuecomment-429348812","issue_url":"https://api.github.com/repos/brainblocks/brainblocks/issues/74","id":429348812,"node_id":"MDEyOklzc3VlQ29tbWVudDQyOTM0ODgxMg==","user":{"login":"timint","id":359192,"node_id":"MDQ6VXNlcjM1OTE5Mg==","avatar_url":"https://avatars0.githubusercontent.com/u/359192?v=4","gravatar_id":"","url":"https://api.github.com/users/timint","html_url":"https://github.com/timint","followers_url":"https://api.github.com/users/timint/followers","following_url":"https://api.github.com/users/timint/following{/other_user}","gists_url":"https://api.github.com/users/timint/gists{/gist_id}","starred_url":"https://api.github.com/users/timint/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timint/subscriptions","organizations_url":"https://api.github.com/users/timint/orgs","repos_url":"https://api.github.com/users/timint/repos","events_url":"https://api.github.com/users/timint/events{/privacy}","received_events_url":"https://api.github.com/users/timint/received_events","type":"User","site_admin":false},"created_at":"2018-10-12T14:39:52Z","updated_at":"2018-10-12T14:39:52Z","author_association":"NONE","body":"@bluepnume Thanks. Where is this doc located?\r\n\r\nI am the founder of LiteCart and I have a BrainBlocks payment module fit and ready for you. But I want to wait until a reference field or m2m initiation is in place before release. Is this something you wanna host on your Github account?"}}
{"actor":{"display_login":"timint"}}