{"action":"created","comment":{"url":"https://api.github.com/repos/openstax/concept-coach/pulls/comments/44030114","id":44030114,"diff_hunk":"@@ -0,0 +1,72 @@\n+React = require 'react'\n+\n+api   = require '../api'\n+User  = require './model'\n+\n+UserLogin = React.createClass\n+\n+  PropTypes:\n+    onComplete: React.PropTypes.func.isRequired\n+\n+  getInitialState: ->\n+    width: '100%', height: 400, currentTitle: ''\n+\n+  # called by iframe when it's content is loaded and it's ready for requests\n+  iFrameReady: ->\n+    @sendCommand('displayLogin', User.endpoints.iframe_login)\n+\n+  setUser: (user) ->\n+    User.update(user)\n+\n+  setTitle: (title) ->\n+    @setState(currentTitle: title)\n+\n+  # called when an login process completes\n+  onLogin: (payload) ->\n+    api.channel.emit 'user.receive.statusUpdate', data: payload\n+    @props.onComplete()\n+\n+  pageLoad: (page) ->\n+    console.log \"Loaded #{page}\"\n+\n+  # Note: we're currently not doing anything with the width because we want that to stay at 100%\n+  pageResize: ({width, height}) ->\n+    @setState(height: height)\n+\n+  sendCommand: (command, payload) ->\n+    msg = JSON.stringify(data: {\"#{command}\": payload})\n+    React.findDOMNode(@refs.iframe).contentWindow.postMessage(msg, '*')\n+\n+  parseAndDispatchMessage: (msg) ->\n+    return unless @isMounted()\n+    try\n+      json = JSON.parse(msg.data)\n+      return unless json.sourceWindowName is 'OxAccountIframe'\n+      for method, payload of json.data\n+        if @[method]\n+          @[method](payload)\n+        else\n+          console.warn?(\"Received message for unsupported #{method}\")\n+    catch error\n+      console.warn(error)\n+\n+  componentWillUnmount: ->\n+    window.removeEventListener('message', @parseAndDispatchMessage)\n+  componentDidMount: ->\n+    window.addEventListener('message', @parseAndDispatchMessage)\n+\n+  render: ->\n+    # the other side of the iframe will validate our address and then only send messages to it\n+    me = window.location.protocol + '//' + window.location.host\n+    url = \"#{User.endpoints.accounts_iframe}?parent=#{me}\"","path":"src/user/login.cjsx","position":61,"original_position":61,"commit_id":"c004647989e41c195ab669078b12dffc9b19422b","original_commit_id":"c004647989e41c195ab669078b12dffc9b19422b","user":{"login":"nathanstitt","id":79566,"avatar_url":"https://avatars.githubusercontent.com/u/79566?v=3","gravatar_id":"","url":"https://api.github.com/users/nathanstitt","html_url":"https://github.com/nathanstitt","followers_url":"https://api.github.com/users/nathanstitt/followers","following_url":"https://api.github.com/users/nathanstitt/following{/other_user}","gists_url":"https://api.github.com/users/nathanstitt/gists{/gist_id}","starred_url":"https://api.github.com/users/nathanstitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nathanstitt/subscriptions","organizations_url":"https://api.github.com/users/nathanstitt/orgs","repos_url":"https://api.github.com/users/nathanstitt/repos","events_url":"https://api.github.com/users/nathanstitt/events{/privacy}","received_events_url":"https://api.github.com/users/nathanstitt/received_events","type":"User","site_admin":false},"body":"Yes the `parent` query string is the key to secure use of postMessage.  Accounts receives the url and verifies it matches one of the pre-set valid urls (cnx.org in production, localhost:8001 on dev).  Provided the `parent` matches, it is used as the `targetOrigin` parameter for postMessage.\r\n\r\nSo yes a site could create an iframe with the parent set to `cnx.org`.   However, the evil site would not receive any of the messages indicating the status because the parent iframe wasn't actually on `cnx.org`. \r\n\r\nI'm now working on the accounts PR and am also going to attempt to set the X-Frame-Options header based on the validated parent.  I think that may stop malicious framing altogether.","created_at":"2015-11-05T16:09:26Z","updated_at":"2015-11-05T16:09:26Z","html_url":"https://github.com/openstax/concept-coach/pull/5#discussion_r44030114","pull_request_url":"https://api.github.com/repos/openstax/concept-coach/pulls/5","_links":{"self":{"href":"https://api.github.com/repos/openstax/concept-coach/pulls/comments/44030114"},"html":{"href":"https://github.com/openstax/concept-coach/pull/5#discussion_r44030114"},"pull_request":{"href":"https://api.github.com/repos/openstax/concept-coach/pulls/5"}}},"pull_request":{"url":"https://api.github.com/repos/openstax/concept-coach/pulls/5","id":49771028,"html_url":"https://github.com/openstax/concept-coach/pull/5","diff_url":"https://github.com/openstax/concept-coach/pull/5.diff","patch_url":"https://github.com/openstax/concept-coach/pull/5.patch","issue_url":"https://api.github.com/repos/openstax/concept-coach/issues/5","number":5,"state":"open","locked":false,"title":"Login component that loads account login","user":{"login":"nathanstitt","id":79566,"avatar_url":"https://avatars.githubusercontent.com/u/79566?v=3","gravatar_id":"","url":"https://api.github.com/users/nathanstitt","html_url":"https://github.com/nathanstitt","followers_url":"https://api.github.com/users/nathanstitt/followers","following_url":"https://api.github.com/users/nathanstitt/following{/other_user}","gists_url":"https://api.github.com/users/nathanstitt/gists{/gist_id}","starred_url":"https://api.github.com/users/nathanstitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nathanstitt/subscriptions","organizations_url":"https://api.github.com/users/nathanstitt/orgs","repos_url":"https://api.github.com/users/nathanstitt/repos","events_url":"https://api.github.com/users/nathanstitt/events{/privacy}","received_events_url":"https://api.github.com/users/nathanstitt/received_events","type":"User","site_admin":false},"body":"Goes along with https://github.com/openstax/tutor-server/pull/774\r\n\r\n<img width=\"661\" alt=\"screen shot 2015-11-04 at 7 23 11 pm\" src=\"https://github-cloud.s3.amazonaws.com/assets%2F79566%2F10957393%2F8cb8bf76-8329-11e5-8b1d-5c1c1c1d957b.png\">","created_at":"2015-11-05T01:24:26Z","updated_at":"2015-11-05T16:09:26Z","closed_at":null,"merged_at":null,"merge_commit_sha":"c480c12c72da16fc0f4a531f40e261cb4121f3eb","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openstax/concept-coach/pulls/5/commits","review_comments_url":"https://api.github.com/repos/openstax/concept-coach/pulls/5/comments","review_comment_url":"https://api.github.com/repos/openstax/concept-coach/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openstax/concept-coach/issues/5/comments","statuses_url":"https://api.github.com/repos/openstax/concept-coach/statuses/c004647989e41c195ab669078b12dffc9b19422b","head":{"label":"openstax:login","ref":"login","sha":"c004647989e41c195ab669078b12dffc9b19422b","user":{"login":"openstax","id":3805549,"avatar_url":"https://avatars.githubusercontent.com/u/3805549?v=3","gravatar_id":"","url":"https://api.github.com/users/openstax","html_url":"https://github.com/openstax","followers_url":"https://api.github.com/users/openstax/followers","following_url":"https://api.github.com/users/openstax/following{/other_user}","gists_url":"https://api.github.com/users/openstax/gists{/gist_id}","starred_url":"https://api.github.com/users/openstax/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openstax/subscriptions","organizations_url":"https://api.github.com/users/openstax/orgs","repos_url":"https://api.github.com/users/openstax/repos","events_url":"https://api.github.com/users/openstax/events{/privacy}","received_events_url":"https://api.github.com/users/openstax/received_events","type":"Organization","site_admin":false},"repo":{"id":45049813,"name":"concept-coach","full_name":"openstax/concept-coach","owner":{"login":"openstax","id":3805549,"avatar_url":"https://avatars.githubusercontent.com/u/3805549?v=3","gravatar_id":"","url":"https://api.github.com/users/openstax","html_url":"https://github.com/openstax","followers_url":"https://api.github.com/users/openstax/followers","following_url":"https://api.github.com/users/openstax/following{/other_user}","gists_url":"https://api.github.com/users/openstax/gists{/gist_id}","starred_url":"https://api.github.com/users/openstax/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openstax/subscriptions","organizations_url":"https://api.github.com/users/openstax/orgs","repos_url":"https://api.github.com/users/openstax/repos","events_url":"https://api.github.com/users/openstax/events{/privacy}","received_events_url":"https://api.github.com/users/openstax/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openstax/concept-coach","description":"","fork":false,"url":"https://api.github.com/repos/openstax/concept-coach","forks_url":"https://api.github.com/repos/openstax/concept-coach/forks","keys_url":"https://api.github.com/repos/openstax/concept-coach/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openstax/concept-coach/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openstax/concept-coach/teams","hooks_url":"https://api.github.com/repos/openstax/concept-coach/hooks","issue_events_url":"https://api.github.com/repos/openstax/concept-coach/issues/events{/number}","events_url":"https://api.github.com/repos/openstax/concept-coach/events","assignees_url":"https://api.github.com/repos/openstax/concept-coach/assignees{/user}","branches_url":"https://api.github.com/repos/openstax/concept-coach/branches{/branch}","tags_url":"https://api.github.com/repos/openstax/concept-coach/tags","blobs_url":"https://api.github.com/repos/openstax/concept-coach/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openstax/concept-coach/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openstax/concept-coach/git/refs{/sha}","trees_url":"https://api.github.com/repos/openstax/concept-coach/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openstax/concept-coach/statuses/{sha}","languages_url":"https://api.github.com/repos/openstax/concept-coach/languages","stargazers_url":"https://api.github.com/repos/openstax/concept-coach/stargazers","contributors_url":"https://api.github.com/repos/openstax/concept-coach/contributors","subscribers_url":"https://api.github.com/repos/openstax/concept-coach/subscribers","subscription_url":"https://api.github.com/repos/openstax/concept-coach/subscription","commits_url":"https://api.github.com/repos/openstax/concept-coach/commits{/sha}","git_commits_url":"https://api.github.com/repos/openstax/concept-coach/git/commits{/sha}","comments_url":"https://api.github.com/repos/openstax/concept-coach/comments{/number}","issue_comment_url":"https://api.github.com/repos/openstax/concept-coach/issues/comments{/number}","contents_url":"https://api.github.com/repos/openstax/concept-coach/contents/{+path}","compare_url":"https://api.github.com/repos/openstax/concept-coach/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openstax/concept-coach/merges","archive_url":"https://api.github.com/repos/openstax/concept-coach/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openstax/concept-coach/downloads","issues_url":"https://api.github.com/repos/openstax/concept-coach/issues{/number}","pulls_url":"https://api.github.com/repos/openstax/concept-coach/pulls{/number}","milestones_url":"https://api.github.com/repos/openstax/concept-coach/milestones{/number}","notifications_url":"https://api.github.com/repos/openstax/concept-coach/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openstax/concept-coach/labels{/name}","releases_url":"https://api.github.com/repos/openstax/concept-coach/releases{/id}","created_at":"2015-10-27T15:18:51Z","updated_at":"2015-10-29T19:17:36Z","pushed_at":"2015-11-05T01:24:27Z","git_url":"git://github.com/openstax/concept-coach.git","ssh_url":"git@github.com:openstax/concept-coach.git","clone_url":"https://github.com/openstax/concept-coach.git","svn_url":"https://github.com/openstax/concept-coach","homepage":null,"size":702,"stargazers_count":1,"watchers_count":1,"language":"CoffeeScript","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":1,"default_branch":"master"}},"base":{"label":"openstax:master","ref":"master","sha":"ca5a19abe3f1712f3d7798a0fe9e19c388560398","user":{"login":"openstax","id":3805549,"avatar_url":"https://avatars.githubusercontent.com/u/3805549?v=3","gravatar_id":"","url":"https://api.github.com/users/openstax","html_url":"https://github.com/openstax","followers_url":"https://api.github.com/users/openstax/followers","following_url":"https://api.github.com/users/openstax/following{/other_user}","gists_url":"https://api.github.com/users/openstax/gists{/gist_id}","starred_url":"https://api.github.com/users/openstax/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openstax/subscriptions","organizations_url":"https://api.github.com/users/openstax/orgs","repos_url":"https://api.github.com/users/openstax/repos","events_url":"https://api.github.com/users/openstax/events{/privacy}","received_events_url":"https://api.github.com/users/openstax/received_events","type":"Organization","site_admin":false},"repo":{"id":45049813,"name":"concept-coach","full_name":"openstax/concept-coach","owner":{"login":"openstax","id":3805549,"avatar_url":"https://avatars.githubusercontent.com/u/3805549?v=3","gravatar_id":"","url":"https://api.github.com/users/openstax","html_url":"https://github.com/openstax","followers_url":"https://api.github.com/users/openstax/followers","following_url":"https://api.github.com/users/openstax/following{/other_user}","gists_url":"https://api.github.com/users/openstax/gists{/gist_id}","starred_url":"https://api.github.com/users/openstax/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openstax/subscriptions","organizations_url":"https://api.github.com/users/openstax/orgs","repos_url":"https://api.github.com/users/openstax/repos","events_url":"https://api.github.com/users/openstax/events{/privacy}","received_events_url":"https://api.github.com/users/openstax/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openstax/concept-coach","description":"","fork":false,"url":"https://api.github.com/repos/openstax/concept-coach","forks_url":"https://api.github.com/repos/openstax/concept-coach/forks","keys_url":"https://api.github.com/repos/openstax/concept-coach/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openstax/concept-coach/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openstax/concept-coach/teams","hooks_url":"https://api.github.com/repos/openstax/concept-coach/hooks","issue_events_url":"https://api.github.com/repos/openstax/concept-coach/issues/events{/number}","events_url":"https://api.github.com/repos/openstax/concept-coach/events","assignees_url":"https://api.github.com/repos/openstax/concept-coach/assignees{/user}","branches_url":"https://api.github.com/repos/openstax/concept-coach/branches{/branch}","tags_url":"https://api.github.com/repos/openstax/concept-coach/tags","blobs_url":"https://api.github.com/repos/openstax/concept-coach/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openstax/concept-coach/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openstax/concept-coach/git/refs{/sha}","trees_url":"https://api.github.com/repos/openstax/concept-coach/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openstax/concept-coach/statuses/{sha}","languages_url":"https://api.github.com/repos/openstax/concept-coach/languages","stargazers_url":"https://api.github.com/repos/openstax/concept-coach/stargazers","contributors_url":"https://api.github.com/repos/openstax/concept-coach/contributors","subscribers_url":"https://api.github.com/repos/openstax/concept-coach/subscribers","subscription_url":"https://api.github.com/repos/openstax/concept-coach/subscription","commits_url":"https://api.github.com/repos/openstax/concept-coach/commits{/sha}","git_commits_url":"https://api.github.com/repos/openstax/concept-coach/git/commits{/sha}","comments_url":"https://api.github.com/repos/openstax/concept-coach/comments{/number}","issue_comment_url":"https://api.github.com/repos/openstax/concept-coach/issues/comments{/number}","contents_url":"https://api.github.com/repos/openstax/concept-coach/contents/{+path}","compare_url":"https://api.github.com/repos/openstax/concept-coach/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openstax/concept-coach/merges","archive_url":"https://api.github.com/repos/openstax/concept-coach/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openstax/concept-coach/downloads","issues_url":"https://api.github.com/repos/openstax/concept-coach/issues{/number}","pulls_url":"https://api.github.com/repos/openstax/concept-coach/pulls{/number}","milestones_url":"https://api.github.com/repos/openstax/concept-coach/milestones{/number}","notifications_url":"https://api.github.com/repos/openstax/concept-coach/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openstax/concept-coach/labels{/name}","releases_url":"https://api.github.com/repos/openstax/concept-coach/releases{/id}","created_at":"2015-10-27T15:18:51Z","updated_at":"2015-10-29T19:17:36Z","pushed_at":"2015-11-05T01:24:27Z","git_url":"git://github.com/openstax/concept-coach.git","ssh_url":"git@github.com:openstax/concept-coach.git","clone_url":"https://github.com/openstax/concept-coach.git","svn_url":"https://github.com/openstax/concept-coach","homepage":null,"size":702,"stargazers_count":1,"watchers_count":1,"language":"CoffeeScript","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":1,"forks":0,"open_issues":1,"watchers":1,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openstax/concept-coach/pulls/5"},"html":{"href":"https://github.com/openstax/concept-coach/pull/5"},"issue":{"href":"https://api.github.com/repos/openstax/concept-coach/issues/5"},"comments":{"href":"https://api.github.com/repos/openstax/concept-coach/issues/5/comments"},"review_comments":{"href":"https://api.github.com/repos/openstax/concept-coach/pulls/5/comments"},"review_comment":{"href":"https://api.github.com/repos/openstax/concept-coach/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openstax/concept-coach/pulls/5/commits"},"statuses":{"href":"https://api.github.com/repos/openstax/concept-coach/statuses/c004647989e41c195ab669078b12dffc9b19422b"}}}}