{"action":"created","issue":{"url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/900","labels_url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/900/labels{/name}","comments_url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/900/comments","events_url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/900/events","html_url":"https://github.com/remotestorage/remotestorage.js/issues/900","id":111644491,"number":900,"title":"add 'state' parameter to OAuth authorize request (prevent CSRF)","user":{"login":"fkooman","id":616885,"avatar_url":"https://avatars.githubusercontent.com/u/616885?v=3","gravatar_id":"","url":"https://api.github.com/users/fkooman","html_url":"https://github.com/fkooman","followers_url":"https://api.github.com/users/fkooman/followers","following_url":"https://api.github.com/users/fkooman/following{/other_user}","gists_url":"https://api.github.com/users/fkooman/gists{/gist_id}","starred_url":"https://api.github.com/users/fkooman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fkooman/subscriptions","organizations_url":"https://api.github.com/users/fkooman/orgs","repos_url":"https://api.github.com/users/fkooman/repos","events_url":"https://api.github.com/users/fkooman/events{/privacy}","received_events_url":"https://api.github.com/users/fkooman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":22,"created_at":"2015-10-15T15:36:23Z","updated_at":"2015-10-16T12:40:20Z","closed_at":null,"body":"```\r\n   state\r\n         RECOMMENDED.  An opaque value used by the client to maintain\r\n         state between the request and callback.  The authorization\r\n         server includes this value when redirecting the user-agent back\r\n         to the client.  The parameter SHOULD be used for preventing\r\n         cross-site request forgery as described in Section 10.12.\r\n```\r\n\r\nhttp://tools.ietf.org/html/rfc6749#section-4.1.1\r\nhttp://tools.ietf.org/html/rfc6749#section-10.12\r\n\r\nActually, the specification is **TOO WEAK** here, it is actually a **MUST** to prevent CSRF:\r\n\r\nhttp://homakov.blogspot.nl/2012/08/saferweb-oauth2a-or-lets-just-fix-it.html"},"comment":{"url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/comments/148706015","html_url":"https://github.com/remotestorage/remotestorage.js/issues/900#issuecomment-148706015","issue_url":"https://api.github.com/repos/remotestorage/remotestorage.js/issues/900","id":148706015,"user":{"login":"skddc","id":842,"avatar_url":"https://avatars.githubusercontent.com/u/842?v=3","gravatar_id":"","url":"https://api.github.com/users/skddc","html_url":"https://github.com/skddc","followers_url":"https://api.github.com/users/skddc/followers","following_url":"https://api.github.com/users/skddc/following{/other_user}","gists_url":"https://api.github.com/users/skddc/gists{/gist_id}","starred_url":"https://api.github.com/users/skddc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/skddc/subscriptions","organizations_url":"https://api.github.com/users/skddc/orgs","repos_url":"https://api.github.com/users/skddc/repos","events_url":"https://api.github.com/users/skddc/events{/privacy}","received_events_url":"https://api.github.com/users/skddc/received_events","type":"User","site_admin":false},"created_at":"2015-10-16T12:40:20Z","updated_at":"2015-10-16T12:40:20Z","body":"> It could even prompt whether the user is fine with that. It probably should try a sync with the old credentials and data to avoid data loss.\r\n\r\nPrompt is a great idea!"}}