{"action":"created","issue":{"url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/131","labels_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/131/labels{/name}","comments_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/131/comments","events_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/131/events","html_url":"https://github.com/lynndylanhurley/devise_token_auth/issues/131","id":56500974,"number":131,"title":"Sudo action / confirm your identity protocol","user":{"login":"nicolas-besnard","id":1261670,"avatar_url":"https://avatars.githubusercontent.com/u/1261670?v=3","gravatar_id":"","url":"https://api.github.com/users/nicolas-besnard","html_url":"https://github.com/nicolas-besnard","followers_url":"https://api.github.com/users/nicolas-besnard/followers","following_url":"https://api.github.com/users/nicolas-besnard/following{/other_user}","gists_url":"https://api.github.com/users/nicolas-besnard/gists{/gist_id}","starred_url":"https://api.github.com/users/nicolas-besnard/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nicolas-besnard/subscriptions","organizations_url":"https://api.github.com/users/nicolas-besnard/orgs","repos_url":"https://api.github.com/users/nicolas-besnard/repos","events_url":"https://api.github.com/users/nicolas-besnard/events{/privacy}","received_events_url":"https://api.github.com/users/nicolas-besnard/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-04T09:22:58Z","updated_at":"2015-02-04T17:51:05Z","closed_at":null,"body":"I would like to implement a \"confirm your identity\" protocol. It's the same thing Github do when you try to change some of your personal information.\r\n\r\nFor example, when you want to change your password, even if you have a valid token, you'll be required to enter your password.\r\n\r\nWhen you'll hit the route `/users` with the `PUT` header, the server return something like \"you need to confirm your identity\". Then a request is made at `/users/sudo` with your password, and you can now change your password or do whatever action that require a confirmation.\r\n\r\nI don't know if understandable, seems good in my head ^^"},"comment":{"url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/comments/72903049","html_url":"https://github.com/lynndylanhurley/devise_token_auth/issues/131#issuecomment-72903049","issue_url":"https://api.github.com/repos/lynndylanhurley/devise_token_auth/issues/131","id":72903049,"user":{"login":"lynndylanhurley","id":468037,"avatar_url":"https://avatars.githubusercontent.com/u/468037?v=3","gravatar_id":"","url":"https://api.github.com/users/lynndylanhurley","html_url":"https://github.com/lynndylanhurley","followers_url":"https://api.github.com/users/lynndylanhurley/followers","following_url":"https://api.github.com/users/lynndylanhurley/following{/other_user}","gists_url":"https://api.github.com/users/lynndylanhurley/gists{/gist_id}","starred_url":"https://api.github.com/users/lynndylanhurley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lynndylanhurley/subscriptions","organizations_url":"https://api.github.com/users/lynndylanhurley/orgs","repos_url":"https://api.github.com/users/lynndylanhurley/repos","events_url":"https://api.github.com/users/lynndylanhurley/events{/privacy}","received_events_url":"https://api.github.com/users/lynndylanhurley/received_events","type":"User","site_admin":false},"created_at":"2015-02-04T17:51:05Z","updated_at":"2015-02-04T17:51:05Z","body":"I agree that this would be a useful feature. \r\n\r\nThe question is, how do we determine which information requires \"sudo\" access? For example, do we require confirmation by model, or by model attribute? And do we need it to behave differently for admins, moderators, etc.?\r\n\r\nI guess I'm asking if this is something that we can generalize, or is this something that must be handled differently for each individual app?"}}