{"action":"created","issue":{"url":"https://api.github.com/repos/websharks/zencache-pro/issues/203","labels_url":"https://api.github.com/repos/websharks/zencache-pro/issues/203/labels{/name}","comments_url":"https://api.github.com/repos/websharks/zencache-pro/issues/203/comments","events_url":"https://api.github.com/repos/websharks/zencache-pro/issues/203/events","html_url":"https://github.com/websharks/zencache-pro/pull/203","id":123994706,"number":203,"title":"Add option to cache nonce values","user":{"login":"raamdev","id":53005,"avatar_url":"https://avatars.githubusercontent.com/u/53005?v=3","gravatar_id":"","url":"https://api.github.com/users/raamdev","html_url":"https://github.com/raamdev","followers_url":"https://api.github.com/users/raamdev/followers","following_url":"https://api.github.com/users/raamdev/following{/other_user}","gists_url":"https://api.github.com/users/raamdev/gists{/gist_id}","starred_url":"https://api.github.com/users/raamdev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raamdev/subscriptions","organizations_url":"https://api.github.com/users/raamdev/orgs","repos_url":"https://api.github.com/users/raamdev/repos","events_url":"https://api.github.com/users/raamdev/events{/privacy}","received_events_url":"https://api.github.com/users/raamdev/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-12-27T20:12:17Z","updated_at":"2015-12-30T04:14:06Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/websharks/zencache-pro/pulls/203","html_url":"https://github.com/websharks/zencache-pro/pull/203","diff_url":"https://github.com/websharks/zencache-pro/pull/203.diff","patch_url":"https://github.com/websharks/zencache-pro/pull/203.patch"},"body":"See websharks/zencache#637"},"comment":{"url":"https://api.github.com/repos/websharks/zencache-pro/issues/comments/167933486","html_url":"https://github.com/websharks/zencache-pro/pull/203#issuecomment-167933486","issue_url":"https://api.github.com/repos/websharks/zencache-pro/issues/203","id":167933486,"user":{"login":"jaswsinc","id":1563559,"avatar_url":"https://avatars.githubusercontent.com/u/1563559?v=3","gravatar_id":"","url":"https://api.github.com/users/jaswsinc","html_url":"https://github.com/jaswsinc","followers_url":"https://api.github.com/users/jaswsinc/followers","following_url":"https://api.github.com/users/jaswsinc/following{/other_user}","gists_url":"https://api.github.com/users/jaswsinc/gists{/gist_id}","starred_url":"https://api.github.com/users/jaswsinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaswsinc/subscriptions","organizations_url":"https://api.github.com/users/jaswsinc/orgs","repos_url":"https://api.github.com/users/jaswsinc/repos","events_url":"https://api.github.com/users/jaswsinc/events{/privacy}","received_events_url":"https://api.github.com/users/jaswsinc/received_events","type":"User","site_admin":false},"created_at":"2015-12-30T04:14:06Z","updated_at":"2015-12-30T04:14:06Z","body":"> If that were such a big issue, why have we not heard about this at all?\r\n\r\nNot getting reports about this doesn't surprise me, because it's not something that you can easily connect to ZenCache, or even reproduce consistently. It took us really digging in to even discover this ourselves, so I wouldn't expect to have seen a lot of reports about this particular problem.\r\n\r\nHowever, once you realize what caching nonce values can lead to, it's very easy to reproduce it. I would argue that the number of reports we are seeing now (i.e., now that you can more easily diagnose it), is  proof of this having caused problems for people in the past. If you are navigating your site and nonce values are not getting cached, that means previously they _were_ being cached; and that's almost certainly a bad thing. Actions that depend on dynamic nonce values are not seeing what they expect to see, which can lead to all sorts of weird problems.\r\n\r\nI also would not rule out the potential for this to cause a major security issue, should we allow nonce values to be cached. I'm not aware of it ever having been a major security issue, but it worries me to see a unique user-specific security token in any cache file, ever."}}