{"action":"created","issue":{"url":"https://api.github.com/repos/rails/rails/issues/22263","labels_url":"https://api.github.com/repos/rails/rails/issues/22263/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/22263/comments","events_url":"https://api.github.com/repos/rails/rails/issues/22263/events","html_url":"https://github.com/rails/rails/pull/22263","id":116371836,"number":22263,"title":"Add option to verify Origin header in CSRF checks","user":{"login":"mastahyeti","id":1144197,"avatar_url":"https://avatars.githubusercontent.com/u/1144197?v=3","gravatar_id":"","url":"https://api.github.com/users/mastahyeti","html_url":"https://github.com/mastahyeti","followers_url":"https://api.github.com/users/mastahyeti/followers","following_url":"https://api.github.com/users/mastahyeti/following{/other_user}","gists_url":"https://api.github.com/users/mastahyeti/gists{/gist_id}","starred_url":"https://api.github.com/users/mastahyeti/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mastahyeti/subscriptions","organizations_url":"https://api.github.com/users/mastahyeti/orgs","repos_url":"https://api.github.com/users/mastahyeti/repos","events_url":"https://api.github.com/users/mastahyeti/events{/privacy}","received_events_url":"https://api.github.com/users/mastahyeti/received_events","type":"User","site_admin":true},"labels":[],"state":"open","locked":false,"assignee":{"login":"jeremy","id":199,"avatar_url":"https://avatars.githubusercontent.com/u/199?v=3","gravatar_id":"","url":"https://api.github.com/users/jeremy","html_url":"https://github.com/jeremy","followers_url":"https://api.github.com/users/jeremy/followers","following_url":"https://api.github.com/users/jeremy/following{/other_user}","gists_url":"https://api.github.com/users/jeremy/gists{/gist_id}","starred_url":"https://api.github.com/users/jeremy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeremy/subscriptions","organizations_url":"https://api.github.com/users/jeremy/orgs","repos_url":"https://api.github.com/users/jeremy/repos","events_url":"https://api.github.com/users/jeremy/events{/privacy}","received_events_url":"https://api.github.com/users/jeremy/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2015-11-11T16:35:05Z","updated_at":"2015-11-11T19:21:25Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rails/rails/pulls/22263","html_url":"https://github.com/rails/rails/pull/22263","diff_url":"https://github.com/rails/rails/pull/22263.diff","patch_url":"https://github.com/rails/rails/pull/22263.patch"},"body":"We're trying to upstream some of the CSRF improvements we've made at GitHub. This first one is pretty simple. It checks the `Origin` header, if present, against `request.base_url` during the CSRF checks. This isn't *fixing* any existing problem, but adds another layer of defense to the Rails CSRF mitigations.\r\n\r\n/cc @oreoshake @ptoomey3"},"comment":{"url":"https://api.github.com/repos/rails/rails/issues/comments/155884147","html_url":"https://github.com/rails/rails/pull/22263#issuecomment-155884147","issue_url":"https://api.github.com/repos/rails/rails/issues/22263","id":155884147,"user":{"login":"rafaelfranca","id":47848,"avatar_url":"https://avatars.githubusercontent.com/u/47848?v=3","gravatar_id":"","url":"https://api.github.com/users/rafaelfranca","html_url":"https://github.com/rafaelfranca","followers_url":"https://api.github.com/users/rafaelfranca/followers","following_url":"https://api.github.com/users/rafaelfranca/following{/other_user}","gists_url":"https://api.github.com/users/rafaelfranca/gists{/gist_id}","starred_url":"https://api.github.com/users/rafaelfranca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rafaelfranca/subscriptions","organizations_url":"https://api.github.com/users/rafaelfranca/orgs","repos_url":"https://api.github.com/users/rafaelfranca/repos","events_url":"https://api.github.com/users/rafaelfranca/events{/privacy}","received_events_url":"https://api.github.com/users/rafaelfranca/received_events","type":"User","site_admin":false},"created_at":"2015-11-11T19:21:25Z","updated_at":"2015-11-11T19:21:25Z","body":"Review @rails/security "}}