{"action":"created","issue":{"url":"https://api.github.com/repos/paulelliott/authem/issues/27","labels_url":"https://api.github.com/repos/paulelliott/authem/issues/27/labels{/name}","comments_url":"https://api.github.com/repos/paulelliott/authem/issues/27/comments","events_url":"https://api.github.com/repos/paulelliott/authem/issues/27/events","html_url":"https://github.com/paulelliott/authem/pull/27","id":82578464,"number":27,"title":"Fix vulnerability to CSRF token fixation attack","user":{"login":"tsubery","id":1638049,"avatar_url":"https://avatars.githubusercontent.com/u/1638049?v=3","gravatar_id":"","url":"https://api.github.com/users/tsubery","html_url":"https://github.com/tsubery","followers_url":"https://api.github.com/users/tsubery/followers","following_url":"https://api.github.com/users/tsubery/following{/other_user}","gists_url":"https://api.github.com/users/tsubery/gists{/gist_id}","starred_url":"https://api.github.com/users/tsubery/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tsubery/subscriptions","organizations_url":"https://api.github.com/users/tsubery/orgs","repos_url":"https://api.github.com/users/tsubery/repos","events_url":"https://api.github.com/users/tsubery/events{/privacy}","received_events_url":"https://api.github.com/users/tsubery/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-29T20:39:20Z","updated_at":"2015-05-30T14:50:26Z","closed_at":"2015-05-30T14:31:54Z","pull_request":{"url":"https://api.github.com/repos/paulelliott/authem/pulls/27","html_url":"https://github.com/paulelliott/authem/pull/27","diff_url":"https://github.com/paulelliott/authem/pull/27.diff","patch_url":"https://github.com/paulelliott/authem/pull/27.patch"},"body":"This is how the vulnerability can be exploited:\r\nLet's say Alice visits Bob house and opens http:/bank.com.\r\nBob's wifi can set her session with a known csrf.\r\nEven if she would be transferred to https after login it would be too late.\r\nLater she visits another site and Bob's wifi can inject enough javascript to post a valid request to bank.com with a valid session & csrf and steal her money.\r\nReseting the csrf on sign-in would render that request invalid and save the day.\r\n\r\nJose Valim wrote about it [here](http://blog.plataformatec.com.br/2013/08/csrf-token-fixation-attacks-in-devise/)"},"comment":{"url":"https://api.github.com/repos/paulelliott/authem/issues/comments/107048919","html_url":"https://github.com/paulelliott/authem/pull/27#issuecomment-107048919","issue_url":"https://api.github.com/repos/paulelliott/authem/issues/27","id":107048919,"user":{"login":"paulelliott","id":58612,"avatar_url":"https://avatars.githubusercontent.com/u/58612?v=3","gravatar_id":"","url":"https://api.github.com/users/paulelliott","html_url":"https://github.com/paulelliott","followers_url":"https://api.github.com/users/paulelliott/followers","following_url":"https://api.github.com/users/paulelliott/following{/other_user}","gists_url":"https://api.github.com/users/paulelliott/gists{/gist_id}","starred_url":"https://api.github.com/users/paulelliott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulelliott/subscriptions","organizations_url":"https://api.github.com/users/paulelliott/orgs","repos_url":"https://api.github.com/users/paulelliott/repos","events_url":"https://api.github.com/users/paulelliott/events{/privacy}","received_events_url":"https://api.github.com/users/paulelliott/received_events","type":"User","site_admin":false},"created_at":"2015-05-30T14:50:26Z","updated_at":"2015-05-30T14:50:26Z","body":"Oh, that's a good point. @rondale-sc, would you care to comment?"}}