{"action":"created","issue":{"url":"https://api.github.com/repos/railsware/js-routes/issues/166","labels_url":"https://api.github.com/repos/railsware/js-routes/issues/166/labels{/name}","comments_url":"https://api.github.com/repos/railsware/js-routes/issues/166/comments","events_url":"https://api.github.com/repos/railsware/js-routes/issues/166/events","html_url":"https://github.com/railsware/js-routes/issues/166","id":108091591,"number":166,"title":"Not exposing any routes to an attacker, but still accessible by javascript","user":{"login":"brightbits","id":196514,"avatar_url":"https://avatars.githubusercontent.com/u/196514?v=3","gravatar_id":"","url":"https://api.github.com/users/brightbits","html_url":"https://github.com/brightbits","followers_url":"https://api.github.com/users/brightbits/followers","following_url":"https://api.github.com/users/brightbits/following{/other_user}","gists_url":"https://api.github.com/users/brightbits/gists{/gist_id}","starred_url":"https://api.github.com/users/brightbits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brightbits/subscriptions","organizations_url":"https://api.github.com/users/brightbits/orgs","repos_url":"https://api.github.com/users/brightbits/repos","events_url":"https://api.github.com/users/brightbits/events{/privacy}","received_events_url":"https://api.github.com/users/brightbits/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-24T09:26:19Z","updated_at":"2015-09-24T13:04:53Z","closed_at":null,"body":"It'd be cool to store the routes with the key being hashed, then the value being encrypted with the original key. This way nothing would be gained by looking at the routes, only when you made use of a route would it expose it (and if you're using an admin_deploy_nukes_path, you'll have probably authenticated them already)\r\n\r\nexample:\r\n\r\n```\r\nrouteMap = {\r\n \"<sha1 of admin_deploy_nukes_path>\": \"<AES encrypted path, with the key admin_deploy_nukes_path>\"\r\n}\r\n\r\nfindRoute = (routeName) ->\r\n  hashedRouteName = SHA1(routeName)\r\n  AES.decrypt(routeMap[hashedRouteName], routeName) #assuming (data, key)\r\n```\r\n\r\nOf course this would require 2 extra libraries but I guess they're pretty small and the amount of data being encrypted/hashed would be small, so pretty quick. \r\n\r\nMaybe overkill but might be a nice option?"},"comment":{"url":"https://api.github.com/repos/railsware/js-routes/issues/comments/142921023","html_url":"https://github.com/railsware/js-routes/issues/166#issuecomment-142921023","issue_url":"https://api.github.com/repos/railsware/js-routes/issues/166","id":142921023,"user":{"login":"bogdan","id":122436,"avatar_url":"https://avatars.githubusercontent.com/u/122436?v=3","gravatar_id":"","url":"https://api.github.com/users/bogdan","html_url":"https://github.com/bogdan","followers_url":"https://api.github.com/users/bogdan/followers","following_url":"https://api.github.com/users/bogdan/following{/other_user}","gists_url":"https://api.github.com/users/bogdan/gists{/gist_id}","starred_url":"https://api.github.com/users/bogdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bogdan/subscriptions","organizations_url":"https://api.github.com/users/bogdan/orgs","repos_url":"https://api.github.com/users/bogdan/repos","events_url":"https://api.github.com/users/bogdan/events{/privacy}","received_events_url":"https://api.github.com/users/bogdan/received_events","type":"User","site_admin":false},"created_at":"2015-09-24T13:04:53Z","updated_at":"2015-09-24T13:04:53Z","body":"That looks interesting as an idea. I don't see a way of implementing that without changing an API as you call a route like this:\r\n\r\n``` js\r\nRoutes.user_path(1)\r\n// but not like\r\nRoutes.run(:user_path, 1)\r\n```\r\n\r\nThis is kind a big deal and I don't think that a lot of people will want it even if they are seriously security-concerned.\r\n\r\nIt could be done in ruby without changing an API with method missing that is not available on JS.\r\nLet's think of a way to do it without API change or other concerns.\r\n"}}