{"action":"created","issue":{"url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/52","labels_url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/52/labels{/name}","comments_url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/52/comments","events_url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/52/events","html_url":"https://github.com/intridea/omniauth-oauth2/issues/52","id":26591379,"number":52,"title":"Design issue - GET => POST","user":{"login":"homakov","id":174693,"avatar_url":"https://avatars.githubusercontent.com/u/174693?v=3","gravatar_id":"","url":"https://api.github.com/users/homakov","html_url":"https://github.com/homakov","followers_url":"https://api.github.com/users/homakov/followers","following_url":"https://api.github.com/users/homakov/following{/other_user}","gists_url":"https://api.github.com/users/homakov/gists{/gist_id}","starred_url":"https://api.github.com/users/homakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/homakov/subscriptions","organizations_url":"https://api.github.com/users/homakov/orgs","repos_url":"https://api.github.com/users/homakov/repos","events_url":"https://api.github.com/users/homakov/events{/privacy}","received_events_url":"https://api.github.com/users/homakov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2014-01-30T11:19:25Z","updated_at":"2015-03-01T18:51:11Z","closed_at":null,"body":"Related http://homakov.blogspot.com/2014/01/two-severe-wontfix-vulnerabilities-in.html\r\n\r\nWhen we load GET /connect/facebook it starts auth flow automatically. It's login fixation by-default. Since it's a state changing request we should use either POST /connect/fb with appropriate csrf_token or, more likely, /connect/fb?authenticity_token=CURRENT_TOKEN.\r\n\r\nThis is not much of a breaking change, but will protect from account hijacking for those websites connecting Providers to master account as login options. "},"comment":{"url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/comments/76623703","html_url":"https://github.com/intridea/omniauth-oauth2/issues/52#issuecomment-76623703","issue_url":"https://api.github.com/repos/intridea/omniauth-oauth2/issues/52","id":76623703,"user":{"login":"homakov","id":174693,"avatar_url":"https://avatars.githubusercontent.com/u/174693?v=3","gravatar_id":"","url":"https://api.github.com/users/homakov","html_url":"https://github.com/homakov","followers_url":"https://api.github.com/users/homakov/followers","following_url":"https://api.github.com/users/homakov/following{/other_user}","gists_url":"https://api.github.com/users/homakov/gists{/gist_id}","starred_url":"https://api.github.com/users/homakov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/homakov/subscriptions","organizations_url":"https://api.github.com/users/homakov/orgs","repos_url":"https://api.github.com/users/homakov/repos","events_url":"https://api.github.com/users/homakov/events{/privacy}","received_events_url":"https://api.github.com/users/homakov/received_events","type":"User","site_admin":false},"created_at":"2015-03-01T18:51:11Z","updated_at":"2015-03-01T18:51:11Z","body":"bump"}}