{"action":"created","comment":{"url":"https://api.github.com/repos/auth0/blog/pulls/comments/194786216","pull_request_review_id":128010733,"id":194786216,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDE5NDc4NjIxNg==","diff_hunk":"@@ -0,0 +1,209 @@\n+---\n+layout: post\n+title: \"Token Security: Stop Putting Your Users At Risk\"\n+description: \"Access tokens are a credential that can be used by a client to access a service, like an API. Like any credential—passwords for instance—they should be kept safe and secure.\"\n+date: 2018-03-28 23:23\n+category: Hot Topics, Security\n+author:\n+  name: Luke Oliff\n+  url: https://twitter.com/mroliff\n+  avatar: https://avatars1.githubusercontent.com/u/956290?s=200\n+  mail: luke.oliff@auth0.com\n+design:\n+  bg_color: \"#222228\"\n+  image: https://cdn.auth0.com/blog/series-c/auth0-logo.png\n+tags:\n+- security\n+- access-tokens\n+- token-storage\n+- localStorage\n+- jwt\n+- auth\n+- breaches\n+related:\n+- 2018-02-27-8-ways-to-avoid-healthcare-breaches\n+- 2018-02-14-what-is-data-security\n+- 2018-03-22-cambridge-analytica-and-facebook§t\n+---\n+\n+**TL;DR:** We explore keeping your tokens and your user’s data safe. `localStorage` has been used as an example of how to store access tokens, especially in single-page applications (SPAs). Auth0 has an alternative to storing a token for a persistent user session, so your returning users can stay logged in without putting them at unnecessary risk.\n+\n+## Storing tokens on the frontend—don’t do it\n+\n+Access tokens are a credential that can be used by a client to access a service, like an application programming interface (API). Like any credential—passwords for instance—they should be kept safe and secure.\n+\n+{% include tweet_quote.html quote_text=\"Are you putting your users at unnecessary risk? If you store access tokens in your frontend app, you might be!\" %}\n+\n+You should not be storing anything as sensitive as credentials anywhere they can be accessed by a third party and unfortunately storing it in your frontend application is asking for trouble.\n+\n+Attackers are actively looking for places you might be exposing sensitive data and they’re using more elaborate methods all the time. The last thing you need to do is make it easy for them.\n+\n+A common place for storing tokens on the frontend is JavaScript’s [`Web Storage API`](https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage)—which should be considered insecure. Better known by their function names, `localStorage` and `sessionStorage`.\n+\n+The benefit of the `Web Storage API` is that it’s purely JavaScript and allows you to store up to 5MB of data. The data can be stored as string data only, therefore it has no logic or state. But it can be serialized along with its context (i.e. as JSON object). With `localStorage`, storage persists on that domain until such time as it’s deleted by the user or the site. This is unlike `sessionStorage` only in that `sessionStorage` persists data limited to the length of that browsing session.\n+\n+The problem with the `Web Storage API` is that it assumes anyone who can access it, also has permission to be accessing it. This is because it’s only accessible by JavaScript and based on the current origin or domain. But, this means it’s vulnerable to XSS attacks. Especially so because it’s stored in such a readily available format. It’s easier to use, but easier to abuse. For example, running the JavaScript below in your browser console will loop over every item on that site's `localStorage` and output the keys **and the values**.\n+\n+```js\n+Object.keys(localStorage).forEach(function(key){\n+   console.log(`${key}: ${localStorage.getItem(key)}`);\n+});\n+```\n+\n+> “So what? That doesn’t help an attacker get your tokens. That's just what I can run on my console!”—You (maybe).\n+\n+Let's speak theoretically. Imagine for a moment that an attacker can place some JavaScript on your site. Replace the `console.log()` above with an [XHR](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest) script and **off goes your users data to some other server**.\n+\n+What if you’re using [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) to stop anything but your trusted vendor's scripts from running on your application? What if you’re using [Subresource Integrity](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity) to ensure even those vendors scripts can’t open up vulnerabilities on your application? Those **are** pretty good ways to protect your application! ***Those security steps should be taken anyway!*** But can you be 100% certain it’s safe? Avoiding storing tokens on the frontend is the best way.\n+\n+**Remember, having someone’s access token can be as good as having their username and password, and you wouldn’t ever risk exposing your username and password.**\n+\n+{% include tweet_quote.html quote_text=\"Having someone’s access token can be as good as having their username and password, and you wouldn’t ever risk exposing your username and password\" %}\n+\n+## The complexity of web applications\n+\n+In the 1990’s world of basic web development, you had monolithic applications that handled user management, stored sensitive data, processed requests and returned some HTML to our screen. Those applications acted as both our server and our client application, all rolled into one.\n+\n+In the years that followed, developers made that HTML prettier and prettier, and more interactive. But they essentially still had one application which kept our user's credentials and session secure—for the most part—in the backend and still returned HTML to the frontend. Our monolithic application is **one single application**, and its just sending HTML down to our browser, which is more or less just a dumb client that lets us click on our new pretty buttons and links.\n+\n+At this point, the browser is not actively involved in any logic. All you need to do with each request is to identify the user is who they were at the start of their browsing session. In such a case you would use cookies, because that's what they were designed for, a single party that has no need to expose anything with any potential sensitivity.\n+\n+Roll on two decades of user experience improvements and technological advancements and you land smack bang in the world of single-page applications (SPAs). An SPA is essentially software that runs in the browser. When you load up a new website, you download very thin code that comes with all the necessaries to be able to communicate with a server.\n+\n+The server remains essentially the same as our old 1990's application, but it’s learned some tricks. It has had an upgrade. It only talks in computer language now—HTTP requests sending and receiving JSON payloads. It’s now called an API and it doesn't return HTML anymore. Instead, it leaves the HTML up to the SPA.\n+\n+Web tokens were designed for cases like this, in cases where there are *two or more applications*, such as our API and our SPA. It allows the SPA to talk to the API, where you can identify the authorized user. If you don't protect your tokens with all the responsibility you give other credentials and then the token it’s accessed by a bad actor, they could access your API on behalf of that your user.\n+\n+**Now imagine that the API is a bank, and the SPA is a user's online banking software.**\n+\n+## Auth0’s old guides—they store tokens in localStorage!\n+\n+We’re way ahead of you! We’re working hard to update our existing guides.\n+\n+A lot of people will still go ahead and use `localStorage` assuming they’ll never be vulnerable to XSS attacks, having taken the appropriate steps to protect against it.\n+\n+That’s ok, but it’s only responsible for **Auth0 to teach you the most secure way**.","path":"_posts/2018-03-28-token-security-stop-putting-your-users-at-risk.markdown","position":85,"original_position":85,"commit_id":"a79173458473a4273977e03e828ef6e8d4239e3a","original_commit_id":"a79173458473a4273977e03e828ef6e8d4239e3a","user":{"login":"kmaida","id":1884525,"node_id":"MDQ6VXNlcjE4ODQ1MjU=","avatar_url":"https://avatars1.githubusercontent.com/u/1884525?v=4","gravatar_id":"","url":"https://api.github.com/users/kmaida","html_url":"https://github.com/kmaida","followers_url":"https://api.github.com/users/kmaida/followers","following_url":"https://api.github.com/users/kmaida/following{/other_user}","gists_url":"https://api.github.com/users/kmaida/gists{/gist_id}","starred_url":"https://api.github.com/users/kmaida/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kmaida/subscriptions","organizations_url":"https://api.github.com/users/kmaida/orgs","repos_url":"https://api.github.com/users/kmaida/repos","events_url":"https://api.github.com/users/kmaida/events{/privacy}","received_events_url":"https://api.github.com/users/kmaida/received_events","type":"User","site_admin":false},"body":"`ok` -> \"okay\"\r\n\r\nI'd rephrase the last part of this sentence too. It sounds kind of strange with the word `only` in it. ","created_at":"2018-06-12T15:33:19Z","updated_at":"2018-06-12T16:02:12Z","html_url":"https://github.com/auth0/blog/pull/1440#discussion_r194786216","pull_request_url":"https://api.github.com/repos/auth0/blog/pulls/1440","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/auth0/blog/pulls/comments/194786216"},"html":{"href":"https://github.com/auth0/blog/pull/1440#discussion_r194786216"},"pull_request":{"href":"https://api.github.com/repos/auth0/blog/pulls/1440"}}},"pull_request":{"url":"https://api.github.com/repos/auth0/blog/pulls/1440","id":178183496,"node_id":"MDExOlB1bGxSZXF1ZXN0MTc4MTgzNDk2","html_url":"https://github.com/auth0/blog/pull/1440","diff_url":"https://github.com/auth0/blog/pull/1440.diff","patch_url":"https://github.com/auth0/blog/pull/1440.patch","issue_url":"https://api.github.com/repos/auth0/blog/issues/1440","number":1440,"state":"open","locked":false,"title":"Token Security: Stop Putting Your Users At Risk","user":{"login":"lukeoliff","id":956290,"node_id":"MDQ6VXNlcjk1NjI5MA==","avatar_url":"https://avatars0.githubusercontent.com/u/956290?v=4","gravatar_id":"","url":"https://api.github.com/users/lukeoliff","html_url":"https://github.com/lukeoliff","followers_url":"https://api.github.com/users/lukeoliff/followers","following_url":"https://api.github.com/users/lukeoliff/following{/other_user}","gists_url":"https://api.github.com/users/lukeoliff/gists{/gist_id}","starred_url":"https://api.github.com/users/lukeoliff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukeoliff/subscriptions","organizations_url":"https://api.github.com/users/lukeoliff/orgs","repos_url":"https://api.github.com/users/lukeoliff/repos","events_url":"https://api.github.com/users/lukeoliff/events{/privacy}","received_events_url":"https://api.github.com/users/lukeoliff/received_events","type":"User","site_admin":false},"body":"","created_at":"2018-03-28T22:37:54Z","updated_at":"2018-06-12T16:02:13Z","closed_at":null,"merged_at":null,"merge_commit_sha":"7ebd359d401f3119f61b87ade54480d5d812a615","assignee":null,"assignees":[],"requested_reviewers":[{"login":"jaredhanson","id":10355,"node_id":"MDQ6VXNlcjEwMzU1","avatar_url":"https://avatars3.githubusercontent.com/u/10355?v=4","gravatar_id":"","url":"https://api.github.com/users/jaredhanson","html_url":"https://github.com/jaredhanson","followers_url":"https://api.github.com/users/jaredhanson/followers","following_url":"https://api.github.com/users/jaredhanson/following{/other_user}","gists_url":"https://api.github.com/users/jaredhanson/gists{/gist_id}","starred_url":"https://api.github.com/users/jaredhanson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaredhanson/subscriptions","organizations_url":"https://api.github.com/users/jaredhanson/orgs","repos_url":"https://api.github.com/users/jaredhanson/repos","events_url":"https://api.github.com/users/jaredhanson/events{/privacy}","received_events_url":"https://api.github.com/users/jaredhanson/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":635256222,"node_id":"MDU6TGFiZWw2MzUyNTYyMjI=","url":"https://api.github.com/repos/auth0/blog/labels/Needs%20Assets%20%F0%9F%91%A9%E2%80%8D%F0%9F%8E%A8","name":"Needs Assets 👩‍🎨","color":"f9d0c4","default":false},{"id":525959883,"node_id":"MDU6TGFiZWw1MjU5NTk4ODM=","url":"https://api.github.com/repos/auth0/blog/labels/Needs%20Review%20%F0%9F%A4%94","name":"Needs Review 🤔","color":"fbca04","default":false},{"id":738967783,"node_id":"MDU6TGFiZWw3Mzg5Njc3ODM=","url":"https://api.github.com/repos/auth0/blog/labels/Needs%20SEO%20Review%20%F0%9F%A7%99%E2%80%8D%E2%99%82%EF%B8%8F","name":"Needs SEO Review 🧙‍♂️","color":"ffc9f9","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/auth0/blog/pulls/1440/commits","review_comments_url":"https://api.github.com/repos/auth0/blog/pulls/1440/comments","review_comment_url":"https://api.github.com/repos/auth0/blog/pulls/comments{/number}","comments_url":"https://api.github.com/repos/auth0/blog/issues/1440/comments","statuses_url":"https://api.github.com/repos/auth0/blog/statuses/a79173458473a4273977e03e828ef6e8d4239e3a","head":{"label":"lukeoliff:lukeoliff/token-security-stop-putting-your-users-at-risk","ref":"lukeoliff/token-security-stop-putting-your-users-at-risk","sha":"a79173458473a4273977e03e828ef6e8d4239e3a","user":{"login":"lukeoliff","id":956290,"node_id":"MDQ6VXNlcjk1NjI5MA==","avatar_url":"https://avatars0.githubusercontent.com/u/956290?v=4","gravatar_id":"","url":"https://api.github.com/users/lukeoliff","html_url":"https://github.com/lukeoliff","followers_url":"https://api.github.com/users/lukeoliff/followers","following_url":"https://api.github.com/users/lukeoliff/following{/other_user}","gists_url":"https://api.github.com/users/lukeoliff/gists{/gist_id}","starred_url":"https://api.github.com/users/lukeoliff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukeoliff/subscriptions","organizations_url":"https://api.github.com/users/lukeoliff/orgs","repos_url":"https://api.github.com/users/lukeoliff/repos","events_url":"https://api.github.com/users/lukeoliff/events{/privacy}","received_events_url":"https://api.github.com/users/lukeoliff/received_events","type":"User","site_admin":false},"repo":{"id":106184635,"node_id":"MDEwOlJlcG9zaXRvcnkxMDYxODQ2MzU=","name":"auth0-blog","full_name":"lukeoliff/auth0-blog","owner":{"login":"lukeoliff","id":956290,"node_id":"MDQ6VXNlcjk1NjI5MA==","avatar_url":"https://avatars0.githubusercontent.com/u/956290?v=4","gravatar_id":"","url":"https://api.github.com/users/lukeoliff","html_url":"https://github.com/lukeoliff","followers_url":"https://api.github.com/users/lukeoliff/followers","following_url":"https://api.github.com/users/lukeoliff/following{/other_user}","gists_url":"https://api.github.com/users/lukeoliff/gists{/gist_id}","starred_url":"https://api.github.com/users/lukeoliff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lukeoliff/subscriptions","organizations_url":"https://api.github.com/users/lukeoliff/orgs","repos_url":"https://api.github.com/users/lukeoliff/repos","events_url":"https://api.github.com/users/lukeoliff/events{/privacy}","received_events_url":"https://api.github.com/users/lukeoliff/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/lukeoliff/auth0-blog","description":"auth0 blog","fork":true,"url":"https://api.github.com/repos/lukeoliff/auth0-blog","forks_url":"https://api.github.com/repos/lukeoliff/auth0-blog/forks","keys_url":"https://api.github.com/repos/lukeoliff/auth0-blog/keys{/key_id}","collaborators_url":"https://api.github.com/repos/lukeoliff/auth0-blog/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/lukeoliff/auth0-blog/teams","hooks_url":"https://api.github.com/repos/lukeoliff/auth0-blog/hooks","issue_events_url":"https://api.github.com/repos/lukeoliff/auth0-blog/issues/events{/number}","events_url":"https://api.github.com/repos/lukeoliff/auth0-blog/events","assignees_url":"https://api.github.com/repos/lukeoliff/auth0-blog/assignees{/user}","branches_url":"https://api.github.com/repos/lukeoliff/auth0-blog/branches{/branch}","tags_url":"https://api.github.com/repos/lukeoliff/auth0-blog/tags","blobs_url":"https://api.github.com/repos/lukeoliff/auth0-blog/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/lukeoliff/auth0-blog/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/lukeoliff/auth0-blog/git/refs{/sha}","trees_url":"https://api.github.com/repos/lukeoliff/auth0-blog/git/trees{/sha}","statuses_url":"https://api.github.com/repos/lukeoliff/auth0-blog/statuses/{sha}","languages_url":"https://api.github.com/repos/lukeoliff/auth0-blog/languages","stargazers_url":"https://api.github.com/repos/lukeoliff/auth0-blog/stargazers","contributors_url":"https://api.github.com/repos/lukeoliff/auth0-blog/contributors","subscribers_url":"https://api.github.com/repos/lukeoliff/auth0-blog/subscribers","subscription_url":"https://api.github.com/repos/lukeoliff/auth0-blog/subscription","commits_url":"https://api.github.com/repos/lukeoliff/auth0-blog/commits{/sha}","git_commits_url":"https://api.github.com/repos/lukeoliff/auth0-blog/git/commits{/sha}","comments_url":"https://api.github.com/repos/lukeoliff/auth0-blog/comments{/number}","issue_comment_url":"https://api.github.com/repos/lukeoliff/auth0-blog/issues/comments{/number}","contents_url":"https://api.github.com/repos/lukeoliff/auth0-blog/contents/{+path}","compare_url":"https://api.github.com/repos/lukeoliff/auth0-blog/compare/{base}...{head}","merges_url":"https://api.github.com/repos/lukeoliff/auth0-blog/merges","archive_url":"https://api.github.com/repos/lukeoliff/auth0-blog/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/lukeoliff/auth0-blog/downloads","issues_url":"https://api.github.com/repos/lukeoliff/auth0-blog/issues{/number}","pulls_url":"https://api.github.com/repos/lukeoliff/auth0-blog/pulls{/number}","milestones_url":"https://api.github.com/repos/lukeoliff/auth0-blog/milestones{/number}","notifications_url":"https://api.github.com/repos/lukeoliff/auth0-blog/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/lukeoliff/auth0-blog/labels{/name}","releases_url":"https://api.github.com/repos/lukeoliff/auth0-blog/releases{/id}","deployments_url":"https://api.github.com/repos/lukeoliff/auth0-blog/deployments","created_at":"2017-10-08T14:54:41Z","updated_at":"2018-05-31T15:18:43Z","pushed_at":"2018-06-12T14:29:29Z","git_url":"git://github.com/lukeoliff/auth0-blog.git","ssh_url":"git@github.com:lukeoliff/auth0-blog.git","clone_url":"https://github.com/lukeoliff/auth0-blog.git","svn_url":"https://github.com/lukeoliff/auth0-blog","homepage":"https://auth0.com/blog","size":28847,"stargazers_count":1,"watchers_count":1,"language":"HTML","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":0,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"auth0:master","ref":"master","sha":"51849b1d95ca122c4ec9e1638605464b18fccf52","user":{"login":"auth0","id":2824157,"node_id":"MDEyOk9yZ2FuaXphdGlvbjI4MjQxNTc=","avatar_url":"https://avatars1.githubusercontent.com/u/2824157?v=4","gravatar_id":"","url":"https://api.github.com/users/auth0","html_url":"https://github.com/auth0","followers_url":"https://api.github.com/users/auth0/followers","following_url":"https://api.github.com/users/auth0/following{/other_user}","gists_url":"https://api.github.com/users/auth0/gists{/gist_id}","starred_url":"https://api.github.com/users/auth0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/auth0/subscriptions","organizations_url":"https://api.github.com/users/auth0/orgs","repos_url":"https://api.github.com/users/auth0/repos","events_url":"https://api.github.com/users/auth0/events{/privacy}","received_events_url":"https://api.github.com/users/auth0/received_events","type":"Organization","site_admin":false},"repo":{"id":7830124,"node_id":"MDEwOlJlcG9zaXRvcnk3ODMwMTI0","name":"blog","full_name":"auth0/blog","owner":{"login":"auth0","id":2824157,"node_id":"MDEyOk9yZ2FuaXphdGlvbjI4MjQxNTc=","avatar_url":"https://avatars1.githubusercontent.com/u/2824157?v=4","gravatar_id":"","url":"https://api.github.com/users/auth0","html_url":"https://github.com/auth0","followers_url":"https://api.github.com/users/auth0/followers","following_url":"https://api.github.com/users/auth0/following{/other_user}","gists_url":"https://api.github.com/users/auth0/gists{/gist_id}","starred_url":"https://api.github.com/users/auth0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/auth0/subscriptions","organizations_url":"https://api.github.com/users/auth0/orgs","repos_url":"https://api.github.com/users/auth0/repos","events_url":"https://api.github.com/users/auth0/events{/privacy}","received_events_url":"https://api.github.com/users/auth0/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/auth0/blog","description":"auth0 blog","fork":false,"url":"https://api.github.com/repos/auth0/blog","forks_url":"https://api.github.com/repos/auth0/blog/forks","keys_url":"https://api.github.com/repos/auth0/blog/keys{/key_id}","collaborators_url":"https://api.github.com/repos/auth0/blog/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/auth0/blog/teams","hooks_url":"https://api.github.com/repos/auth0/blog/hooks","issue_events_url":"https://api.github.com/repos/auth0/blog/issues/events{/number}","events_url":"https://api.github.com/repos/auth0/blog/events","assignees_url":"https://api.github.com/repos/auth0/blog/assignees{/user}","branches_url":"https://api.github.com/repos/auth0/blog/branches{/branch}","tags_url":"https://api.github.com/repos/auth0/blog/tags","blobs_url":"https://api.github.com/repos/auth0/blog/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/auth0/blog/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/auth0/blog/git/refs{/sha}","trees_url":"https://api.github.com/repos/auth0/blog/git/trees{/sha}","statuses_url":"https://api.github.com/repos/auth0/blog/statuses/{sha}","languages_url":"https://api.github.com/repos/auth0/blog/languages","stargazers_url":"https://api.github.com/repos/auth0/blog/stargazers","contributors_url":"https://api.github.com/repos/auth0/blog/contributors","subscribers_url":"https://api.github.com/repos/auth0/blog/subscribers","subscription_url":"https://api.github.com/repos/auth0/blog/subscription","commits_url":"https://api.github.com/repos/auth0/blog/commits{/sha}","git_commits_url":"https://api.github.com/repos/auth0/blog/git/commits{/sha}","comments_url":"https://api.github.com/repos/auth0/blog/comments{/number}","issue_comment_url":"https://api.github.com/repos/auth0/blog/issues/comments{/number}","contents_url":"https://api.github.com/repos/auth0/blog/contents/{+path}","compare_url":"https://api.github.com/repos/auth0/blog/compare/{base}...{head}","merges_url":"https://api.github.com/repos/auth0/blog/merges","archive_url":"https://api.github.com/repos/auth0/blog/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/auth0/blog/downloads","issues_url":"https://api.github.com/repos/auth0/blog/issues{/number}","pulls_url":"https://api.github.com/repos/auth0/blog/pulls{/number}","milestones_url":"https://api.github.com/repos/auth0/blog/milestones{/number}","notifications_url":"https://api.github.com/repos/auth0/blog/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/auth0/blog/labels{/name}","releases_url":"https://api.github.com/repos/auth0/blog/releases{/id}","deployments_url":"https://api.github.com/repos/auth0/blog/deployments","created_at":"2013-01-25T22:57:37Z","updated_at":"2018-06-12T14:26:59Z","pushed_at":"2018-06-12T14:29:30Z","git_url":"git://github.com/auth0/blog.git","ssh_url":"git@github.com:auth0/blog.git","clone_url":"https://github.com/auth0/blog.git","svn_url":"https://github.com/auth0/blog","homepage":"https://auth0.com/blog","size":28792,"stargazers_count":86,"watchers_count":86,"language":"HTML","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":115,"mirror_url":null,"archived":false,"open_issues_count":35,"license":{"key":"mit","name":"MIT License","spdx_id":"MIT","url":"https://api.github.com/licenses/mit","node_id":"MDc6TGljZW5zZTEz"},"forks":115,"open_issues":35,"watchers":86,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/auth0/blog/pulls/1440"},"html":{"href":"https://github.com/auth0/blog/pull/1440"},"issue":{"href":"https://api.github.com/repos/auth0/blog/issues/1440"},"comments":{"href":"https://api.github.com/repos/auth0/blog/issues/1440/comments"},"review_comments":{"href":"https://api.github.com/repos/auth0/blog/pulls/1440/comments"},"review_comment":{"href":"https://api.github.com/repos/auth0/blog/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/auth0/blog/pulls/1440/commits"},"statuses":{"href":"https://api.github.com/repos/auth0/blog/statuses/a79173458473a4273977e03e828ef6e8d4239e3a"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"kmaida"}}