{"action":"opened","issue":{"url":"https://api.github.com/repos/EarthSystemCoG/COG/issues/1123","labels_url":"https://api.github.com/repos/EarthSystemCoG/COG/issues/1123/labels{/name}","comments_url":"https://api.github.com/repos/EarthSystemCoG/COG/issues/1123/comments","events_url":"https://api.github.com/repos/EarthSystemCoG/COG/issues/1123/events","html_url":"https://github.com/EarthSystemCoG/COG/issues/1123","id":103516728,"number":1123,"title":"Add \"secure\" attribute to all sensitive cookies","user":{"login":"LucaCinquini","id":637059,"avatar_url":"https://avatars.githubusercontent.com/u/637059?v=3","gravatar_id":"","url":"https://api.github.com/users/LucaCinquini","html_url":"https://github.com/LucaCinquini","followers_url":"https://api.github.com/users/LucaCinquini/followers","following_url":"https://api.github.com/users/LucaCinquini/following{/other_user}","gists_url":"https://api.github.com/users/LucaCinquini/gists{/gist_id}","starred_url":"https://api.github.com/users/LucaCinquini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LucaCinquini/subscriptions","organizations_url":"https://api.github.com/users/LucaCinquini/orgs","repos_url":"https://api.github.com/users/LucaCinquini/repos","events_url":"https://api.github.com/users/LucaCinquini/events{/privacy}","received_events_url":"https://api.github.com/users/LucaCinquini/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"LucaCinquini","id":637059,"avatar_url":"https://avatars.githubusercontent.com/u/637059?v=3","gravatar_id":"","url":"https://api.github.com/users/LucaCinquini","html_url":"https://github.com/LucaCinquini","followers_url":"https://api.github.com/users/LucaCinquini/followers","following_url":"https://api.github.com/users/LucaCinquini/following{/other_user}","gists_url":"https://api.github.com/users/LucaCinquini/gists{/gist_id}","starred_url":"https://api.github.com/users/LucaCinquini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LucaCinquini/subscriptions","organizations_url":"https://api.github.com/users/LucaCinquini/orgs","repos_url":"https://api.github.com/users/LucaCinquini/repos","events_url":"https://api.github.com/users/LucaCinquini/events{/privacy}","received_events_url":"https://api.github.com/users/LucaCinquini/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/EarthSystemCoG/COG/milestones/69","html_url":"https://github.com/EarthSystemCoG/COG/milestones/Release%202.15","labels_url":"https://api.github.com/repos/EarthSystemCoG/COG/milestones/69/labels","id":1181410,"number":69,"title":"Release 2.15","description":"","creator":{"login":"murphysj","id":1512704,"avatar_url":"https://avatars.githubusercontent.com/u/1512704?v=3","gravatar_id":"","url":"https://api.github.com/users/murphysj","html_url":"https://github.com/murphysj","followers_url":"https://api.github.com/users/murphysj/followers","following_url":"https://api.github.com/users/murphysj/following{/other_user}","gists_url":"https://api.github.com/users/murphysj/gists{/gist_id}","starred_url":"https://api.github.com/users/murphysj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/murphysj/subscriptions","organizations_url":"https://api.github.com/users/murphysj/orgs","repos_url":"https://api.github.com/users/murphysj/repos","events_url":"https://api.github.com/users/murphysj/events{/privacy}","received_events_url":"https://api.github.com/users/murphysj/received_events","type":"User","site_admin":false},"open_issues":18,"closed_issues":1,"state":"open","created_at":"2015-06-25T17:10:12Z","updated_at":"2015-08-27T13:57:50Z","due_on":"2015-09-24T06:00:00Z","closed_at":null},"comments":0,"created_at":"2015-08-27T13:57:50Z","updated_at":"2015-08-27T13:57:50Z","closed_at":null,"body":"Who: Luca\r\n\r\nJPL App Scan identified this \"medium\" security vulnerability:\r\n\r\nBasically the only required attribute for the cookie is the \"name\" field. Common optional attributes are: \"comment\", \"domain\", \"path\", etc.\r\nThe \"secure\" attribute must be set accordingly in order to prevent to cookie from being sent unencrypted.\r\n\r\nRFC 2965 states:\r\n\"The Secure attribute (with no value) directs the user agent to use only (unspecified) secure means to contact the origin server whenever it sends back this cookie, to protect the confidentially and authenticity of the information in the cookie.\"\r\n"}}