{"action":"created","issue":{"url":"https://api.github.com/repos/firebase/php-jwt/issues/33","labels_url":"https://api.github.com/repos/firebase/php-jwt/issues/33/labels{/name}","comments_url":"https://api.github.com/repos/firebase/php-jwt/issues/33/comments","events_url":"https://api.github.com/repos/firebase/php-jwt/issues/33/events","html_url":"https://github.com/firebase/php-jwt/pull/33","id":65616802,"number":33,"title":"Allow users to lock their app into an algorithm.","user":{"login":"sarciszewski","id":3710836,"avatar_url":"https://avatars.githubusercontent.com/u/3710836?v=3","gravatar_id":"","url":"https://api.github.com/users/sarciszewski","html_url":"https://github.com/sarciszewski","followers_url":"https://api.github.com/users/sarciszewski/followers","following_url":"https://api.github.com/users/sarciszewski/following{/other_user}","gists_url":"https://api.github.com/users/sarciszewski/gists{/gist_id}","starred_url":"https://api.github.com/users/sarciszewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sarciszewski/subscriptions","organizations_url":"https://api.github.com/users/sarciszewski/orgs","repos_url":"https://api.github.com/users/sarciszewski/repos","events_url":"https://api.github.com/users/sarciszewski/events{/privacy}","received_events_url":"https://api.github.com/users/sarciszewski/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-01T06:35:26Z","updated_at":"2015-04-01T16:52:05Z","closed_at":"2015-04-01T16:51:42Z","pull_request":{"url":"https://api.github.com/repos/firebase/php-jwt/pulls/33","html_url":"https://github.com/firebase/php-jwt/pull/33","diff_url":"https://github.com/firebase/php-jwt/pull/33.diff","patch_url":"https://github.com/firebase/php-jwt/pull/33.patch"},"body":"In addition to allowing users to lock their JWT class into supporting exactly one specific method at runtime (i.e. when their configuration is loaded) with a sane default, I also locked things down a little bit.\r\n\r\nFirst, http://php.net/manual/en/mbstring.overload.php `mbstring.func_overload` can lead to incorrect results from `strlen()` treating string as UTF-8 instead of binary, which can reduce the cost of brute force for an invalid authentication signature.\r\n\r\nSecond, if `hash_equals()` exists, use that instead of a PHP-land implementation."},"comment":{"url":"https://api.github.com/repos/firebase/php-jwt/issues/comments/88552199","html_url":"https://github.com/firebase/php-jwt/pull/33#issuecomment-88552199","issue_url":"https://api.github.com/repos/firebase/php-jwt/issues/33","id":88552199,"user":{"login":"robertdimarco","id":136118,"avatar_url":"https://avatars.githubusercontent.com/u/136118?v=3","gravatar_id":"","url":"https://api.github.com/users/robertdimarco","html_url":"https://github.com/robertdimarco","followers_url":"https://api.github.com/users/robertdimarco/followers","following_url":"https://api.github.com/users/robertdimarco/following{/other_user}","gists_url":"https://api.github.com/users/robertdimarco/gists{/gist_id}","starred_url":"https://api.github.com/users/robertdimarco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robertdimarco/subscriptions","organizations_url":"https://api.github.com/users/robertdimarco/orgs","repos_url":"https://api.github.com/users/robertdimarco/repos","events_url":"https://api.github.com/users/robertdimarco/events{/privacy}","received_events_url":"https://api.github.com/users/robertdimarco/received_events","type":"User","site_admin":false},"created_at":"2015-04-01T16:52:05Z","updated_at":"2015-04-01T16:52:05Z","body":"@sarciszewski Thanks for the PR! I may make some add'l changes as well; look out for those too."}}