{"action":"created","issue":{"url":"https://api.github.com/repos/za419/GAMR/issues/28","labels_url":"https://api.github.com/repos/za419/GAMR/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/za419/GAMR/issues/28/comments","events_url":"https://api.github.com/repos/za419/GAMR/issues/28/events","html_url":"https://github.com/za419/GAMR/issues/28","id":122148089,"number":28,"title":"Login status currently held by username","user":{"login":"za419","id":15851480,"avatar_url":"https://avatars.githubusercontent.com/u/15851480?v=3","gravatar_id":"","url":"https://api.github.com/users/za419","html_url":"https://github.com/za419","followers_url":"https://api.github.com/users/za419/followers","following_url":"https://api.github.com/users/za419/following{/other_user}","gists_url":"https://api.github.com/users/za419/gists{/gist_id}","starred_url":"https://api.github.com/users/za419/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/za419/subscriptions","organizations_url":"https://api.github.com/users/za419/orgs","repos_url":"https://api.github.com/users/za419/repos","events_url":"https://api.github.com/users/za419/events{/privacy}","received_events_url":"https://api.github.com/users/za419/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/za419/GAMR/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/za419/GAMR/labels/security","name":"security","color":"f7c6c7"}],"state":"open","locked":false,"assignee":{"login":"za419","id":15851480,"avatar_url":"https://avatars.githubusercontent.com/u/15851480?v=3","gravatar_id":"","url":"https://api.github.com/users/za419","html_url":"https://github.com/za419","followers_url":"https://api.github.com/users/za419/followers","following_url":"https://api.github.com/users/za419/following{/other_user}","gists_url":"https://api.github.com/users/za419/gists{/gist_id}","starred_url":"https://api.github.com/users/za419/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/za419/subscriptions","organizations_url":"https://api.github.com/users/za419/orgs","repos_url":"https://api.github.com/users/za419/repos","events_url":"https://api.github.com/users/za419/events{/privacy}","received_events_url":"https://api.github.com/users/za419/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/za419/GAMR/milestones/1","html_url":"https://github.com/za419/GAMR/milestones/Release","labels_url":"https://api.github.com/repos/za419/GAMR/milestones/1/labels","id":1458103,"number":1,"title":"Release","description":"The project is in a working state, able to be used at at least a small scale.","creator":{"login":"za419","id":15851480,"avatar_url":"https://avatars.githubusercontent.com/u/15851480?v=3","gravatar_id":"","url":"https://api.github.com/users/za419","html_url":"https://github.com/za419","followers_url":"https://api.github.com/users/za419/followers","following_url":"https://api.github.com/users/za419/following{/other_user}","gists_url":"https://api.github.com/users/za419/gists{/gist_id}","starred_url":"https://api.github.com/users/za419/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/za419/subscriptions","organizations_url":"https://api.github.com/users/za419/orgs","repos_url":"https://api.github.com/users/za419/repos","events_url":"https://api.github.com/users/za419/events{/privacy}","received_events_url":"https://api.github.com/users/za419/received_events","type":"User","site_admin":false},"open_issues":13,"closed_issues":4,"state":"open","created_at":"2015-12-13T21:07:48Z","updated_at":"2015-12-14T22:38:20Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-12-14T22:38:20Z","updated_at":"2015-12-14T22:57:24Z","closed_at":null,"body":"The current system has the client being regarded as logged into whatever username is stored in the cookie. This is very insecure, as an attacker could easily fake a cookie for an arbitrary user and thus bypass password security altogether.\r\n\r\nThis should be changed to a session mechanism, where the server sends a session id to the client, and then validates it against an existing database such that it only logs in when that id is valid."},"comment":{"url":"https://api.github.com/repos/za419/GAMR/issues/comments/164586900","html_url":"https://github.com/za419/GAMR/issues/28#issuecomment-164586900","issue_url":"https://api.github.com/repos/za419/GAMR/issues/28","id":164586900,"user":{"login":"za419","id":15851480,"avatar_url":"https://avatars.githubusercontent.com/u/15851480?v=3","gravatar_id":"","url":"https://api.github.com/users/za419","html_url":"https://github.com/za419","followers_url":"https://api.github.com/users/za419/followers","following_url":"https://api.github.com/users/za419/following{/other_user}","gists_url":"https://api.github.com/users/za419/gists{/gist_id}","starred_url":"https://api.github.com/users/za419/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/za419/subscriptions","organizations_url":"https://api.github.com/users/za419/orgs","repos_url":"https://api.github.com/users/za419/repos","events_url":"https://api.github.com/users/za419/events{/privacy}","received_events_url":"https://api.github.com/users/za419/received_events","type":"User","site_admin":false},"created_at":"2015-12-14T22:57:24Z","updated_at":"2015-12-14T22:57:24Z","body":"Something to consider: Should the IP address of the client be recorded, so that requests from elsewhere are denied even with a correct session id cookie?\r\n\r\nThis might be viewed as an invasion of privacy, but it would be good for security. Maybe our purposes don't require that kind of security, since we don't have any financial data."}}