{"push_id":802185158,"size":3,"distinct_size":3,"ref":"refs/heads/rememberable-2sv","head":"f38ef5852accb7df3f5c9ae4cc3bde13e080308b","before":"097e40280ec533293b19d6dac79e9b706b9cf0ca","commits":[{"sha":"7a6cc180f0410891b25b5426d560d5e111f93720","author":{"email":"9c380d388050cdb31e87cd3869c5eb2cbeac4079@gmail.com","name":"Paul Bowsher"},"message":"Rename signed expires value to valid_until\n\nPrevents confusion between the expires parameter of the cookie itself,\nand the expiration date signed as part of the cookie to prevent\ntampering.","distinct":true,"url":"https://api.github.com/repos/alphagov/signonotron2/commits/7a6cc180f0410891b25b5426d560d5e111f93720"},{"sha":"a85e23d8673beb5668b5c50c94d94186cfef1de7","author":{"email":"9c380d388050cdb31e87cd3869c5eb2cbeac4079@gmail.com","name":"Paul Bowsher"},"message":"Test tampering with 2SV session cookie expiry\n\nThis tests preserving the 2SV session cookie value past the cookie’s\nexpiry date, or otherwise modifying the expiry date. If we weren’t\nchecking the signed `valid_until` value of the cookie, the user would\nbe able to preserve the cookie and carry on logging in without 2SV\nafter 30 days.","distinct":true,"url":"https://api.github.com/repos/alphagov/signonotron2/commits/a85e23d8673beb5668b5c50c94d94186cfef1de7"},{"sha":"f38ef5852accb7df3f5c9ae4cc3bde13e080308b","author":{"email":"9c380d388050cdb31e87cd3869c5eb2cbeac4079@gmail.com","name":"Paul Bowsher"},"message":"Test using a 2SV session cookie to bypass 2SV for another user\n\nThis asserts that the signed user id in the cookie is checked in order\nto validate the 2SV session cookie. Without this, a user could\nauthenticate themselves with 2SV, copy the cookie, then restore it when\npresented with another user’s 2SV prompt, and bypass it.","distinct":true,"url":"https://api.github.com/repos/alphagov/signonotron2/commits/f38ef5852accb7df3f5c9ae4cc3bde13e080308b"}]}