{"action":"created","issue":{"url":"https://api.github.com/repos/vufind-org/vufind/issues/1243","repository_url":"https://api.github.com/repos/vufind-org/vufind","labels_url":"https://api.github.com/repos/vufind-org/vufind/issues/1243/labels{/name}","comments_url":"https://api.github.com/repos/vufind-org/vufind/issues/1243/comments","events_url":"https://api.github.com/repos/vufind-org/vufind/issues/1243/events","html_url":"https://github.com/vufind-org/vufind/pull/1243","id":369062603,"node_id":"MDExOlB1bGxSZXF1ZXN0MjIyMDkxNDEz","number":1243,"title":"Make most cookies HTTP only by default.","user":{"login":"EreMaijala","id":1327659,"node_id":"MDQ6VXNlcjEzMjc2NTk=","avatar_url":"https://avatars3.githubusercontent.com/u/1327659?v=4","gravatar_id":"","url":"https://api.github.com/users/EreMaijala","html_url":"https://github.com/EreMaijala","followers_url":"https://api.github.com/users/EreMaijala/followers","following_url":"https://api.github.com/users/EreMaijala/following{/other_user}","gists_url":"https://api.github.com/users/EreMaijala/gists{/gist_id}","starred_url":"https://api.github.com/users/EreMaijala/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/EreMaijala/subscriptions","organizations_url":"https://api.github.com/users/EreMaijala/orgs","repos_url":"https://api.github.com/users/EreMaijala/repos","events_url":"https://api.github.com/users/EreMaijala/events{/privacy}","received_events_url":"https://api.github.com/users/EreMaijala/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-11T10:49:24Z","updated_at":"2018-10-11T11:33:38Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/vufind-org/vufind/pulls/1243","html_url":"https://github.com/vufind-org/vufind/pull/1243","diff_url":"https://github.com/vufind-org/vufind/pull/1243.diff","patch_url":"https://github.com/vufind-org/vufind/pull/1243.patch"},"body":"This makes the cookies apart from cart ones httpOnly by default to improve security, and adds an option to reverse this. I'm not sure if the option is really needed, but if there happens to be some custom code that really needs the cookies, at least it's possible."},"comment":{"url":"https://api.github.com/repos/vufind-org/vufind/issues/comments/428921659","html_url":"https://github.com/vufind-org/vufind/pull/1243#issuecomment-428921659","issue_url":"https://api.github.com/repos/vufind-org/vufind/issues/1243","id":428921659,"node_id":"MDEyOklzc3VlQ29tbWVudDQyODkyMTY1OQ==","user":{"login":"demiankatz","id":309069,"node_id":"MDQ6VXNlcjMwOTA2OQ==","avatar_url":"https://avatars3.githubusercontent.com/u/309069?v=4","gravatar_id":"","url":"https://api.github.com/users/demiankatz","html_url":"https://github.com/demiankatz","followers_url":"https://api.github.com/users/demiankatz/followers","following_url":"https://api.github.com/users/demiankatz/following{/other_user}","gists_url":"https://api.github.com/users/demiankatz/gists{/gist_id}","starred_url":"https://api.github.com/users/demiankatz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/demiankatz/subscriptions","organizations_url":"https://api.github.com/users/demiankatz/orgs","repos_url":"https://api.github.com/users/demiankatz/repos","events_url":"https://api.github.com/users/demiankatz/events{/privacy}","received_events_url":"https://api.github.com/users/demiankatz/received_events","type":"User","site_admin":false},"created_at":"2018-10-11T11:33:38Z","updated_at":"2018-10-11T11:33:38Z","author_association":"MEMBER","body":"Is \"HTTP only\" the standard name for this setting? This seems potentially confusing, because (at least in my brain) the HTTP vs. HTTPS distinction is the first thing to come to mind, rather than client-side vs. server-side editing. If this is typically discussed in this way, I can live with it, but if we're making up our own terminology, it could probably stand to be clarified.\r\n\r\nBeyond that, @crhallberg might know best of anyone whether we do any client-side cookie modification outside of the cart.\r\n\r\nI can also run the full test suite on this to see if anything breaks when I get back in the office and after the Summit is over (I'm on vacation today and tomorrow)."}}
{"actor":{"display_login":"demiankatz"}}