{"action":"created","issue":{"url":"https://api.github.com/repos/mohiva/play-silhouette/issues/271","labels_url":"https://api.github.com/repos/mohiva/play-silhouette/issues/271/labels{/name}","comments_url":"https://api.github.com/repos/mohiva/play-silhouette/issues/271/comments","events_url":"https://api.github.com/repos/mohiva/play-silhouette/issues/271/events","html_url":"https://github.com/mohiva/play-silhouette/pull/271","id":55451666,"number":271,"title":"Change header in default Fingerprint generator","user":{"login":"centaure","id":1370619,"avatar_url":"https://avatars.githubusercontent.com/u/1370619?v=3","gravatar_id":"","url":"https://api.github.com/users/centaure","html_url":"https://github.com/centaure","followers_url":"https://api.github.com/users/centaure/followers","following_url":"https://api.github.com/users/centaure/following{/other_user}","gists_url":"https://api.github.com/users/centaure/gists{/gist_id}","starred_url":"https://api.github.com/users/centaure/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/centaure/subscriptions","organizations_url":"https://api.github.com/users/centaure/orgs","repos_url":"https://api.github.com/users/centaure/repos","events_url":"https://api.github.com/users/centaure/events{/privacy}","received_events_url":"https://api.github.com/users/centaure/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-01-26T06:51:27Z","updated_at":"2015-01-26T07:59:22Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/mohiva/play-silhouette/pulls/271","html_url":"https://github.com/mohiva/play-silhouette/pull/271","diff_url":"https://github.com/mohiva/play-silhouette/pull/271.diff","patch_url":"https://github.com/mohiva/play-silhouette/pull/271.patch"},"body":"In default FingerprintGenerator, replace ACCEPT header with ACCEPT-LANGUAGE header (when generating Fingerprint):\r\n\r\nUsing the ACCEPT header field for the default Fingerprint generator will cause problems for applications that use different media types depending on requests. For example, you may have a controller that processes user sign-in POST request RESTfully (accepting \"application/json, text/javascript, /; q=0.01\"); therefore the authenticator and its corresponding fingerprint is created using this JSON etc ACCEPT header. On the other hand, the post-sign-in process may include a Redirect action whose GET request uses the usual HTTP request type i.e. \"text/html,application/xhtml+xml,application/xml;q=0.9\". In this case, silhouette will fail during authenticator retrieval when processing the GET request (because the fingerprints are different). \r\n\r\nAlthough the user can implement his/her own generator in this case, it will be good to avoid the \"ACCEPT\" header for the default generator (so as to remove a potential complication for new users who, for example, use such a mixture of REST and HTML in their API). \r\n\r\nACCEPT-LANGUAGE, on the other hand, will be least likely to be different across request types."},"comment":{"url":"https://api.github.com/repos/mohiva/play-silhouette/issues/comments/71424741","html_url":"https://github.com/mohiva/play-silhouette/pull/271#issuecomment-71424741","issue_url":"https://api.github.com/repos/mohiva/play-silhouette/issues/271","id":71424741,"user":{"login":"akkie","id":307006,"avatar_url":"https://avatars.githubusercontent.com/u/307006?v=3","gravatar_id":"","url":"https://api.github.com/users/akkie","html_url":"https://github.com/akkie","followers_url":"https://api.github.com/users/akkie/followers","following_url":"https://api.github.com/users/akkie/following{/other_user}","gists_url":"https://api.github.com/users/akkie/gists{/gist_id}","starred_url":"https://api.github.com/users/akkie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akkie/subscriptions","organizations_url":"https://api.github.com/users/akkie/orgs","repos_url":"https://api.github.com/users/akkie/repos","events_url":"https://api.github.com/users/akkie/events{/privacy}","received_events_url":"https://api.github.com/users/akkie/received_events","type":"User","site_admin":false},"created_at":"2015-01-26T07:59:22Z","updated_at":"2015-01-26T07:59:22Z","body":"The problem here is that the `Accept` header for a JSON request is defined by the JS library and not by the browser. So if you call a JSON endpoint from JS then you send another header as in a GET request initiated from your browser.\r\n\r\nLet me think a bit about a solution. I'm not sure if we should change the default fingerprint generator. Maybe a better solution would be to create a new one for such a content negotiation scenario. Anyway, the `Accept-Language` header wouldn't be enough. The `Accept-Charset` and `Accept-Encoding` headers are also good candidates to generate a fingerprint of the client."}}