{"action":"opened","number":621,"pull_request":{"url":"https://api.github.com/repos/phoenixframework/phoenix/pulls/621","id":29242136,"html_url":"https://github.com/phoenixframework/phoenix/pull/621","diff_url":"https://github.com/phoenixframework/phoenix/pull/621.diff","patch_url":"https://github.com/phoenixframework/phoenix/pull/621.patch","issue_url":"https://api.github.com/repos/phoenixframework/phoenix/issues/621","number":621,"state":"open","locked":false,"title":"Headers in sockets","user":{"login":"mgwidmann","id":5035724,"avatar_url":"https://avatars.githubusercontent.com/u/5035724?v=3","gravatar_id":"","url":"https://api.github.com/users/mgwidmann","html_url":"https://github.com/mgwidmann","followers_url":"https://api.github.com/users/mgwidmann/followers","following_url":"https://api.github.com/users/mgwidmann/following{/other_user}","gists_url":"https://api.github.com/users/mgwidmann/gists{/gist_id}","starred_url":"https://api.github.com/users/mgwidmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mgwidmann/subscriptions","organizations_url":"https://api.github.com/users/mgwidmann/orgs","repos_url":"https://api.github.com/users/mgwidmann/repos","events_url":"https://api.github.com/users/mgwidmann/events{/privacy}","received_events_url":"https://api.github.com/users/mgwidmann/received_events","type":"User","site_admin":false},"body":"### I'd like to start out by saying how great I think Phoenix is coming along! Great job! :+1: :tada: \r\n\r\nI know this is a painful topic, but I think it needs to be fleshed out if Phoenix is to succeed in the long run. The client-side HMAC token system cannot be the only method of authentication. I think it is an excellent feature though! There are currently, and will be more to come, use cases in which this system fails. First of all, not running the application over SSL immediately makes one time use token a vulnerability. Anyone who sniffs the token and makes the connection to the application first would gain credential access. Secondly, putting a security token on the client side accessible by javascript is a big time security violation by itself. If somehow you do get some kind injection issue (XSS or otherwise), now user tokens are available. This is the reason why session cookies are marked HTTP only and cannot be accessed by javascript. The web is already built this way for a reason.\r\n\r\nIn order to use the token system without a security hole, Phoenix must guarantee SSL and prevention of XSS or other injection issues (and even then I'm still uneasy about the architecture). Those are two tall orders to make, so heres what I propose. **Allow access to the session and headers in websocket connections!**\r\n\r\n#### You may not like what I've done, thats ok if you prefer to reimplement it. But PLEASE consider adding this feature. Phoenix and its awesome web socket system are pretty much useless to me (and likely many others) without it.\r\n\r\n> In case you are wondering what my use case is... \r\n> I have a Phoenix app here: https://github.com/mgwidmann/elixir-rails-websockets which will proxy to a locally configured (still TODO in the phoenix app) rails app so that I may lighten the web socket load on my rails server behind a reverse proxy like nginx. The Phoenix proxy needs to send over the session cookie to the rails app so that it appears transparently that the request came from the client (the rails session cookie most importantly needs to be sent, but other headers could be useful as well). The whole purpose of this is that I have a built rails application (which currently is better suited being built in rails than Phoenix IMO) which needs web socket support on a very limited set of hardware (which I feel MRI cannot handle since I won't be able to have more than a handful of workers). I didn't want to use JRuby or Rubinius as I have already built the app in MRI and it is too risky at this point to change. I will be deploying to production soon, either with my forked version of Phoenix or master, whichever supports this feature.","created_at":"2015-02-13T05:55:52Z","updated_at":"2015-02-13T05:55:52Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/phoenixframework/phoenix/pulls/621/commits","review_comments_url":"https://api.github.com/repos/phoenixframework/phoenix/pulls/621/comments","review_comment_url":"https://api.github.com/repos/phoenixframework/phoenix/pulls/comments/{number}","comments_url":"https://api.github.com/repos/phoenixframework/phoenix/issues/621/comments","statuses_url":"https://api.github.com/repos/phoenixframework/phoenix/statuses/64d2342a655bd7a177f277972961aa004ff89bde","head":{"label":"mgwidmann:headers_in_sockets","ref":"headers_in_sockets","sha":"64d2342a655bd7a177f277972961aa004ff89bde","user":{"login":"mgwidmann","id":5035724,"avatar_url":"https://avatars.githubusercontent.com/u/5035724?v=3","gravatar_id":"","url":"https://api.github.com/users/mgwidmann","html_url":"https://github.com/mgwidmann","followers_url":"https://api.github.com/users/mgwidmann/followers","following_url":"https://api.github.com/users/mgwidmann/following{/other_user}","gists_url":"https://api.github.com/users/mgwidmann/gists{/gist_id}","starred_url":"https://api.github.com/users/mgwidmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mgwidmann/subscriptions","organizations_url":"https://api.github.com/users/mgwidmann/orgs","repos_url":"https://api.github.com/users/mgwidmann/repos","events_url":"https://api.github.com/users/mgwidmann/events{/privacy}","received_events_url":"https://api.github.com/users/mgwidmann/received_events","type":"User","site_admin":false},"repo":{"id":20846591,"name":"phoenix","full_name":"mgwidmann/phoenix","owner":{"login":"mgwidmann","id":5035724,"avatar_url":"https://avatars.githubusercontent.com/u/5035724?v=3","gravatar_id":"","url":"https://api.github.com/users/mgwidmann","html_url":"https://github.com/mgwidmann","followers_url":"https://api.github.com/users/mgwidmann/followers","following_url":"https://api.github.com/users/mgwidmann/following{/other_user}","gists_url":"https://api.github.com/users/mgwidmann/gists{/gist_id}","starred_url":"https://api.github.com/users/mgwidmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mgwidmann/subscriptions","organizations_url":"https://api.github.com/users/mgwidmann/orgs","repos_url":"https://api.github.com/users/mgwidmann/repos","events_url":"https://api.github.com/users/mgwidmann/events{/privacy}","received_events_url":"https://api.github.com/users/mgwidmann/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mgwidmann/phoenix","description":"Elixir Web Framework","fork":true,"url":"https://api.github.com/repos/mgwidmann/phoenix","forks_url":"https://api.github.com/repos/mgwidmann/phoenix/forks","keys_url":"https://api.github.com/repos/mgwidmann/phoenix/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mgwidmann/phoenix/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mgwidmann/phoenix/teams","hooks_url":"https://api.github.com/repos/mgwidmann/phoenix/hooks","issue_events_url":"https://api.github.com/repos/mgwidmann/phoenix/issues/events{/number}","events_url":"https://api.github.com/repos/mgwidmann/phoenix/events","assignees_url":"https://api.github.com/repos/mgwidmann/phoenix/assignees{/user}","branches_url":"https://api.github.com/repos/mgwidmann/phoenix/branches{/branch}","tags_url":"https://api.github.com/repos/mgwidmann/phoenix/tags","blobs_url":"https://api.github.com/repos/mgwidmann/phoenix/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mgwidmann/phoenix/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mgwidmann/phoenix/git/refs{/sha}","trees_url":"https://api.github.com/repos/mgwidmann/phoenix/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mgwidmann/phoenix/statuses/{sha}","languages_url":"https://api.github.com/repos/mgwidmann/phoenix/languages","stargazers_url":"https://api.github.com/repos/mgwidmann/phoenix/stargazers","contributors_url":"https://api.github.com/repos/mgwidmann/phoenix/contributors","subscribers_url":"https://api.github.com/repos/mgwidmann/phoenix/subscribers","subscription_url":"https://api.github.com/repos/mgwidmann/phoenix/subscription","commits_url":"https://api.github.com/repos/mgwidmann/phoenix/commits{/sha}","git_commits_url":"https://api.github.com/repos/mgwidmann/phoenix/git/commits{/sha}","comments_url":"https://api.github.com/repos/mgwidmann/phoenix/comments{/number}","issue_comment_url":"https://api.github.com/repos/mgwidmann/phoenix/issues/comments/{number}","contents_url":"https://api.github.com/repos/mgwidmann/phoenix/contents/{+path}","compare_url":"https://api.github.com/repos/mgwidmann/phoenix/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mgwidmann/phoenix/merges","archive_url":"https://api.github.com/repos/mgwidmann/phoenix/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mgwidmann/phoenix/downloads","issues_url":"https://api.github.com/repos/mgwidmann/phoenix/issues{/number}","pulls_url":"https://api.github.com/repos/mgwidmann/phoenix/pulls{/number}","milestones_url":"https://api.github.com/repos/mgwidmann/phoenix/milestones{/number}","notifications_url":"https://api.github.com/repos/mgwidmann/phoenix/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mgwidmann/phoenix/labels{/name}","releases_url":"https://api.github.com/repos/mgwidmann/phoenix/releases{/id}","created_at":"2014-06-15T02:40:09Z","updated_at":"2015-02-13T04:30:15Z","pushed_at":"2015-02-13T05:21:51Z","git_url":"git://github.com/mgwidmann/phoenix.git","ssh_url":"git@github.com:mgwidmann/phoenix.git","clone_url":"https://github.com/mgwidmann/phoenix.git","svn_url":"https://github.com/mgwidmann/phoenix","homepage":"","size":1866,"stargazers_count":0,"watchers_count":0,"language":"Elixir","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"phoenixframework:master","ref":"master","sha":"73ea14190fa7399aa328a87f35bdc3ce82bec943","user":{"login":"phoenixframework","id":6510388,"avatar_url":"https://avatars.githubusercontent.com/u/6510388?v=3","gravatar_id":"","url":"https://api.github.com/users/phoenixframework","html_url":"https://github.com/phoenixframework","followers_url":"https://api.github.com/users/phoenixframework/followers","following_url":"https://api.github.com/users/phoenixframework/following{/other_user}","gists_url":"https://api.github.com/users/phoenixframework/gists{/gist_id}","starred_url":"https://api.github.com/users/phoenixframework/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phoenixframework/subscriptions","organizations_url":"https://api.github.com/users/phoenixframework/orgs","repos_url":"https://api.github.com/users/phoenixframework/repos","events_url":"https://api.github.com/users/phoenixframework/events{/privacy}","received_events_url":"https://api.github.com/users/phoenixframework/received_events","type":"Organization","site_admin":false},"repo":{"id":16072585,"name":"phoenix","full_name":"phoenixframework/phoenix","owner":{"login":"phoenixframework","id":6510388,"avatar_url":"https://avatars.githubusercontent.com/u/6510388?v=3","gravatar_id":"","url":"https://api.github.com/users/phoenixframework","html_url":"https://github.com/phoenixframework","followers_url":"https://api.github.com/users/phoenixframework/followers","following_url":"https://api.github.com/users/phoenixframework/following{/other_user}","gists_url":"https://api.github.com/users/phoenixframework/gists{/gist_id}","starred_url":"https://api.github.com/users/phoenixframework/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phoenixframework/subscriptions","organizations_url":"https://api.github.com/users/phoenixframework/orgs","repos_url":"https://api.github.com/users/phoenixframework/repos","events_url":"https://api.github.com/users/phoenixframework/events{/privacy}","received_events_url":"https://api.github.com/users/phoenixframework/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/phoenixframework/phoenix","description":"A highly connected web framework for the Elixir programming language","fork":false,"url":"https://api.github.com/repos/phoenixframework/phoenix","forks_url":"https://api.github.com/repos/phoenixframework/phoenix/forks","keys_url":"https://api.github.com/repos/phoenixframework/phoenix/keys{/key_id}","collaborators_url":"https://api.github.com/repos/phoenixframework/phoenix/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/phoenixframework/phoenix/teams","hooks_url":"https://api.github.com/repos/phoenixframework/phoenix/hooks","issue_events_url":"https://api.github.com/repos/phoenixframework/phoenix/issues/events{/number}","events_url":"https://api.github.com/repos/phoenixframework/phoenix/events","assignees_url":"https://api.github.com/repos/phoenixframework/phoenix/assignees{/user}","branches_url":"https://api.github.com/repos/phoenixframework/phoenix/branches{/branch}","tags_url":"https://api.github.com/repos/phoenixframework/phoenix/tags","blobs_url":"https://api.github.com/repos/phoenixframework/phoenix/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/phoenixframework/phoenix/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/phoenixframework/phoenix/git/refs{/sha}","trees_url":"https://api.github.com/repos/phoenixframework/phoenix/git/trees{/sha}","statuses_url":"https://api.github.com/repos/phoenixframework/phoenix/statuses/{sha}","languages_url":"https://api.github.com/repos/phoenixframework/phoenix/languages","stargazers_url":"https://api.github.com/repos/phoenixframework/phoenix/stargazers","contributors_url":"https://api.github.com/repos/phoenixframework/phoenix/contributors","subscribers_url":"https://api.github.com/repos/phoenixframework/phoenix/subscribers","subscription_url":"https://api.github.com/repos/phoenixframework/phoenix/subscription","commits_url":"https://api.github.com/repos/phoenixframework/phoenix/commits{/sha}","git_commits_url":"https://api.github.com/repos/phoenixframework/phoenix/git/commits{/sha}","comments_url":"https://api.github.com/repos/phoenixframework/phoenix/comments{/number}","issue_comment_url":"https://api.github.com/repos/phoenixframework/phoenix/issues/comments/{number}","contents_url":"https://api.github.com/repos/phoenixframework/phoenix/contents/{+path}","compare_url":"https://api.github.com/repos/phoenixframework/phoenix/compare/{base}...{head}","merges_url":"https://api.github.com/repos/phoenixframework/phoenix/merges","archive_url":"https://api.github.com/repos/phoenixframework/phoenix/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/phoenixframework/phoenix/downloads","issues_url":"https://api.github.com/repos/phoenixframework/phoenix/issues{/number}","pulls_url":"https://api.github.com/repos/phoenixframework/phoenix/pulls{/number}","milestones_url":"https://api.github.com/repos/phoenixframework/phoenix/milestones{/number}","notifications_url":"https://api.github.com/repos/phoenixframework/phoenix/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/phoenixframework/phoenix/labels{/name}","releases_url":"https://api.github.com/repos/phoenixframework/phoenix/releases{/id}","created_at":"2014-01-20T14:14:11Z","updated_at":"2015-02-13T05:25:04Z","pushed_at":"2015-02-13T04:48:59Z","git_url":"git://github.com/phoenixframework/phoenix.git","ssh_url":"git@github.com:phoenixframework/phoenix.git","clone_url":"https://github.com/phoenixframework/phoenix.git","svn_url":"https://github.com/phoenixframework/phoenix","homepage":"http://www.phoenixframework.org","size":6776,"stargazers_count":1953,"watchers_count":1953,"language":"Elixir","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":182,"mirror_url":null,"open_issues_count":18,"forks":182,"open_issues":18,"watchers":1953,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/phoenixframework/phoenix/pulls/621"},"html":{"href":"https://github.com/phoenixframework/phoenix/pull/621"},"issue":{"href":"https://api.github.com/repos/phoenixframework/phoenix/issues/621"},"comments":{"href":"https://api.github.com/repos/phoenixframework/phoenix/issues/621/comments"},"review_comments":{"href":"https://api.github.com/repos/phoenixframework/phoenix/pulls/621/comments"},"review_comment":{"href":"https://api.github.com/repos/phoenixframework/phoenix/pulls/comments/{number}"},"commits":{"href":"https://api.github.com/repos/phoenixframework/phoenix/pulls/621/commits"},"statuses":{"href":"https://api.github.com/repos/phoenixframework/phoenix/statuses/64d2342a655bd7a177f277972961aa004ff89bde"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":2,"additions":43,"deletions":40,"changed_files":6}}