{"action":"created","issue":{"url":"https://api.github.com/repos/source-academy/cadet-frontend/issues/108","repository_url":"https://api.github.com/repos/source-academy/cadet-frontend","labels_url":"https://api.github.com/repos/source-academy/cadet-frontend/issues/108/labels{/name}","comments_url":"https://api.github.com/repos/source-academy/cadet-frontend/issues/108/comments","events_url":"https://api.github.com/repos/source-academy/cadet-frontend/issues/108/events","html_url":"https://github.com/source-academy/cadet-frontend/issues/108","id":331078140,"node_id":"MDU6SXNzdWUzMzEwNzgxNDA=","number":108,"title":"Additional authentication call to APIs","user":{"login":"remo5000","id":12512488,"node_id":"MDQ6VXNlcjEyNTEyNDg4","avatar_url":"https://avatars3.githubusercontent.com/u/12512488?v=4","gravatar_id":"","url":"https://api.github.com/users/remo5000","html_url":"https://github.com/remo5000","followers_url":"https://api.github.com/users/remo5000/followers","following_url":"https://api.github.com/users/remo5000/following{/other_user}","gists_url":"https://api.github.com/users/remo5000/gists{/gist_id}","starred_url":"https://api.github.com/users/remo5000/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/remo5000/subscriptions","organizations_url":"https://api.github.com/users/remo5000/orgs","repos_url":"https://api.github.com/users/remo5000/repos","events_url":"https://api.github.com/users/remo5000/events{/privacy}","received_events_url":"https://api.github.com/users/remo5000/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-06-11T07:45:06Z","updated_at":"2018-07-02T08:41:57Z","closed_at":"2018-07-02T08:41:57Z","author_association":"CONTRIBUTOR","body":"Taken from #106 : \r\n\r\n>  think this call could use an API call (without further redirect) to check the validity of the token. Redirection is a possible security threat. For example, (http://localhost/academy?token=SPONGEBOBSQUAREPANTS) creates a valid token in the state, allowing me to view the game (albeit without any relevant content). It is a matter of debate as to when the token is to be validated (as discussed in real life @ningyuansg), but adding an extra check here prevents the user from seeing data that is already present in the website (e.g frontend stuff)\r\n\r\nAdding an additional call to the API (for authenticating the validity of a token) would have a performance hit, but would allow for absolutely no content to be loaded until the token is confirmed to be valid. The alternative works as well -- as all content is loaded from the backend, the token will fail there instead, causing the content to not be loaded. "},"comment":{"url":"https://api.github.com/repos/source-academy/cadet-frontend/issues/comments/401714806","html_url":"https://github.com/source-academy/cadet-frontend/issues/108#issuecomment-401714806","issue_url":"https://api.github.com/repos/source-academy/cadet-frontend/issues/108","id":401714806,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTcxNDgwNg==","user":{"login":"remo5000","id":12512488,"node_id":"MDQ6VXNlcjEyNTEyNDg4","avatar_url":"https://avatars3.githubusercontent.com/u/12512488?v=4","gravatar_id":"","url":"https://api.github.com/users/remo5000","html_url":"https://github.com/remo5000","followers_url":"https://api.github.com/users/remo5000/followers","following_url":"https://api.github.com/users/remo5000/following{/other_user}","gists_url":"https://api.github.com/users/remo5000/gists{/gist_id}","starred_url":"https://api.github.com/users/remo5000/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/remo5000/subscriptions","organizations_url":"https://api.github.com/users/remo5000/orgs","repos_url":"https://api.github.com/users/remo5000/repos","events_url":"https://api.github.com/users/remo5000/events{/privacy}","received_events_url":"https://api.github.com/users/remo5000/received_events","type":"User","site_admin":false},"created_at":"2018-07-02T08:41:57Z","updated_at":"2018-07-02T08:41:57Z","author_association":"CONTRIBUTOR","body":"Closing this because the access token will be used for every content fetch, and the initial IVLE token will be sent to be exchanged for a refresh/access token."}}
{"actor":{"display_login":"remo5000"}}