{"action":"created","issue":{"url":"https://api.github.com/repos/spree/spree/issues/6009","labels_url":"https://api.github.com/repos/spree/spree/issues/6009/labels{/name}","comments_url":"https://api.github.com/repos/spree/spree/issues/6009/comments","events_url":"https://api.github.com/repos/spree/spree/issues/6009/events","html_url":"https://github.com/spree/spree/issues/6009","id":56681471,"number":6009,"title":"Spree API keys vulnerable to timing attacks","user":{"login":"eliotsykes","id":31698,"avatar_url":"https://avatars.githubusercontent.com/u/31698?v=3","gravatar_id":"","url":"https://api.github.com/users/eliotsykes","html_url":"https://github.com/eliotsykes","followers_url":"https://api.github.com/users/eliotsykes/followers","following_url":"https://api.github.com/users/eliotsykes/following{/other_user}","gists_url":"https://api.github.com/users/eliotsykes/gists{/gist_id}","starred_url":"https://api.github.com/users/eliotsykes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eliotsykes/subscriptions","organizations_url":"https://api.github.com/users/eliotsykes/orgs","repos_url":"https://api.github.com/users/eliotsykes/repos","events_url":"https://api.github.com/users/eliotsykes/events{/privacy}","received_events_url":"https://api.github.com/users/eliotsykes/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spree/spree/labels/unverified","name":"unverified","color":"fbca04"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-05T15:05:55Z","updated_at":"2015-02-05T15:10:06Z","closed_at":"2015-02-05T15:10:06Z","body":"Spree API users are found with a query that is vulnerable to timing attacks:\r\n\r\n```ruby\r\nSpree.user_class.find_by(spree_api_key: api_key.to_s))\r\n```\r\n(from Spree 3.0.0.rc1: [`Spree::Api::BaseController#load_user`](https://github.com/spree/spree/blob/v3.0.0.rc1/api/app/controllers/spree/api/base_controller.rb#L67)).\r\n\r\nAn attacker can discover API keys through trial and error of API keys and analysis of the speed of response. \r\n\r\nDevise had this vulnerability (reported by @yfeldblum I believe, who also originally discovered and reported [this same vulnerability with Spree in 2012](https://github.com/spree/spree/issues/2330)). There is a solution given in #2330 and a similar solution was suggested for Devise in [this gist](https://gist.github.com/josevalim/fb706b1e933ef01e4fb6#file-2_safe_token_authentication-rb) (see the 2nd option, not the 1st one which is insecure).\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/spree/spree/issues/comments/73061457","html_url":"https://github.com/spree/spree/issues/6009#issuecomment-73061457","issue_url":"https://api.github.com/repos/spree/spree/issues/6009","id":73061457,"user":{"login":"schof","id":85518,"avatar_url":"https://avatars.githubusercontent.com/u/85518?v=3","gravatar_id":"","url":"https://api.github.com/users/schof","html_url":"https://github.com/schof","followers_url":"https://api.github.com/users/schof/followers","following_url":"https://api.github.com/users/schof/following{/other_user}","gists_url":"https://api.github.com/users/schof/gists{/gist_id}","starred_url":"https://api.github.com/users/schof/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/schof/subscriptions","organizations_url":"https://api.github.com/users/schof/orgs","repos_url":"https://api.github.com/users/schof/repos","events_url":"https://api.github.com/users/schof/events{/privacy}","received_events_url":"https://api.github.com/users/schof/received_events","type":"User","site_admin":false},"created_at":"2015-02-05T15:10:06Z","updated_at":"2015-02-05T15:10:06Z","body":"Please do not report security vulnerabilities (or suspected vulnerabilities) via GH issues.  Please report any suspected issues to security@spreecommerce.com.\r\n\r\nThanks"}}