{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/438","labels_url":"https://api.github.com/repos/aspnet/Security/issues/438/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/438/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/438/events","html_url":"https://github.com/aspnet/Security/pull/438","id":105420477,"number":438,"title":"Verify state via independent cookie.","user":{"login":"Tratcher","id":1821173,"avatar_url":"https://avatars.githubusercontent.com/u/1821173?v=3","gravatar_id":"","url":"https://api.github.com/users/Tratcher","html_url":"https://github.com/Tratcher","followers_url":"https://api.github.com/users/Tratcher/followers","following_url":"https://api.github.com/users/Tratcher/following{/other_user}","gists_url":"https://api.github.com/users/Tratcher/gists{/gist_id}","starred_url":"https://api.github.com/users/Tratcher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tratcher/subscriptions","organizations_url":"https://api.github.com/users/Tratcher/orgs","repos_url":"https://api.github.com/users/Tratcher/repos","events_url":"https://api.github.com/users/Tratcher/events{/privacy}","received_events_url":"https://api.github.com/users/Tratcher/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/Security/labels/cla-already-signed","name":"cla-already-signed","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-09-08T16:35:34Z","updated_at":"2015-09-08T17:21:53Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/aspnet/Security/pulls/438","html_url":"https://github.com/aspnet/Security/pull/438","diff_url":"https://github.com/aspnet/Security/pull/438.diff","patch_url":"https://github.com/aspnet/Security/pull/438.patch"},"body":"#404 \r\nVerify the state parameter with a correlation cookie.\r\nRemoved some brittle logging tests.\r\n\r\n@HaoK @blowdart @Eilon @brentschmaltz @tushargupta51 @muratg \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/138639608","html_url":"https://github.com/aspnet/Security/pull/438#issuecomment-138639608","issue_url":"https://api.github.com/repos/aspnet/Security/issues/438","id":138639608,"user":{"login":"Tratcher","id":1821173,"avatar_url":"https://avatars.githubusercontent.com/u/1821173?v=3","gravatar_id":"","url":"https://api.github.com/users/Tratcher","html_url":"https://github.com/Tratcher","followers_url":"https://api.github.com/users/Tratcher/followers","following_url":"https://api.github.com/users/Tratcher/following{/other_user}","gists_url":"https://api.github.com/users/Tratcher/gists{/gist_id}","starred_url":"https://api.github.com/users/Tratcher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tratcher/subscriptions","organizations_url":"https://api.github.com/users/Tratcher/orgs","repos_url":"https://api.github.com/users/Tratcher/repos","events_url":"https://api.github.com/users/Tratcher/events{/privacy}","received_events_url":"https://api.github.com/users/Tratcher/received_events","type":"User","site_admin":false},"created_at":"2015-09-08T17:21:53Z","updated_at":"2015-09-08T17:21:53Z","body":"@PinpointTownes OAuth does have the same issue but we have never had complaints about it. I think OIDC has been more vulnerable to the issue so far because people are more likely to open multiple tabs referencing the same OIDC login server (e.g. AAD). Since the mitigation has side effects that people have also complained about, I want to see how well the changes work here before applying them to OAuth."}}