{"action":"closed","issue":{"url":"https://api.github.com/repos/bzdeck/bzdeck/issues/298","labels_url":"https://api.github.com/repos/bzdeck/bzdeck/issues/298/labels{/name}","comments_url":"https://api.github.com/repos/bzdeck/bzdeck/issues/298/comments","events_url":"https://api.github.com/repos/bzdeck/bzdeck/issues/298/events","html_url":"https://github.com/bzdeck/bzdeck/issues/298","id":97604745,"number":298,"title":"Make sure Auth Delegation POST requests match the spec","user":{"login":"dylanwh","id":47717,"avatar_url":"https://avatars.githubusercontent.com/u/47717?v=3","gravatar_id":"","url":"https://api.github.com/users/dylanwh","html_url":"https://github.com/dylanwh","followers_url":"https://api.github.com/users/dylanwh/followers","following_url":"https://api.github.com/users/dylanwh/following{/other_user}","gists_url":"https://api.github.com/users/dylanwh/gists{/gist_id}","starred_url":"https://api.github.com/users/dylanwh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dylanwh/subscriptions","organizations_url":"https://api.github.com/users/dylanwh/orgs","repos_url":"https://api.github.com/users/dylanwh/repos","events_url":"https://api.github.com/users/dylanwh/events{/privacy}","received_events_url":"https://api.github.com/users/dylanwh/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/bzdeck/bzdeck/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/bzdeck/bzdeck/labels/integration","name":"integration","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"kyoshino","id":2929505,"avatar_url":"https://avatars.githubusercontent.com/u/2929505?v=3","gravatar_id":"","url":"https://api.github.com/users/kyoshino","html_url":"https://github.com/kyoshino","followers_url":"https://api.github.com/users/kyoshino/followers","following_url":"https://api.github.com/users/kyoshino/following{/other_user}","gists_url":"https://api.github.com/users/kyoshino/gists{/gist_id}","starred_url":"https://api.github.com/users/kyoshino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kyoshino/subscriptions","organizations_url":"https://api.github.com/users/kyoshino/orgs","repos_url":"https://api.github.com/users/kyoshino/repos","events_url":"https://api.github.com/users/kyoshino/events{/privacy}","received_events_url":"https://api.github.com/users/kyoshino/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/bzdeck/bzdeck/milestones/26","html_url":"https://github.com/bzdeck/bzdeck/milestones/Beta%2012","labels_url":"https://api.github.com/repos/bzdeck/bzdeck/milestones/26/labels","id":1243049,"number":26,"title":"Beta 12","description":"Still working on editable bug details and reporter.","creator":{"login":"kyoshino","id":2929505,"avatar_url":"https://avatars.githubusercontent.com/u/2929505?v=3","gravatar_id":"","url":"https://api.github.com/users/kyoshino","html_url":"https://github.com/kyoshino","followers_url":"https://api.github.com/users/kyoshino/followers","following_url":"https://api.github.com/users/kyoshino/following{/other_user}","gists_url":"https://api.github.com/users/kyoshino/gists{/gist_id}","starred_url":"https://api.github.com/users/kyoshino/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kyoshino/subscriptions","organizations_url":"https://api.github.com/users/kyoshino/orgs","repos_url":"https://api.github.com/users/kyoshino/repos","events_url":"https://api.github.com/users/kyoshino/events{/privacy}","received_events_url":"https://api.github.com/users/kyoshino/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":3,"state":"open","created_at":"2015-08-05T23:35:16Z","updated_at":"2015-10-18T05:34:15Z","due_on":"2015-09-01T04:00:00Z","closed_at":null},"comments":1,"created_at":"2015-07-28T03:17:34Z","updated_at":"2015-10-18T05:34:15Z","closed_at":"2015-10-18T05:34:15Z","body":"The current code won't work with the new POST requests. I haven't updated the docs yet, but here's the preview:\r\n\r\nthe callback will receive two requests. The first is from the bugzilla server and is a POST with the api key and login name. These have the same names as they did before.\r\n\r\nBugzilla will expect you to return a json object literal with a single key:\r\n{ \"result\": \"UNIQUE VALUE\" }\r\n\r\nAfterwards, bugzilla will redirect the client (the browser) to the callback with query string parameters client_api_login and callback_result. bzdeck  will need to check the value of callback_result. This will ensure that the GET request is coming from whoever sent the POST.\r\n\r\nGenerating a good \"UNIQUE VALUE\" will require some plumbing... At least a bzdeck-side secret hashed with client_api_login, and at best some server-side token to prevent replay attacks."}}