{"action":"created","issue":{"url":"https://api.github.com/repos/sdelements/lets-chat/issues/327","labels_url":"https://api.github.com/repos/sdelements/lets-chat/issues/327/labels{/name}","comments_url":"https://api.github.com/repos/sdelements/lets-chat/issues/327/comments","events_url":"https://api.github.com/repos/sdelements/lets-chat/issues/327/events","html_url":"https://github.com/sdelements/lets-chat/pull/327","id":59383468,"number":327,"title":"Filter requests based on Origin header to deal with Cross origin request forgery","user":{"login":"geoffwhittington","id":1770544,"avatar_url":"https://avatars.githubusercontent.com/u/1770544?v=3","gravatar_id":"","url":"https://api.github.com/users/geoffwhittington","html_url":"https://github.com/geoffwhittington","followers_url":"https://api.github.com/users/geoffwhittington/followers","following_url":"https://api.github.com/users/geoffwhittington/following{/other_user}","gists_url":"https://api.github.com/users/geoffwhittington/gists{/gist_id}","starred_url":"https://api.github.com/users/geoffwhittington/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoffwhittington/subscriptions","organizations_url":"https://api.github.com/users/geoffwhittington/orgs","repos_url":"https://api.github.com/users/geoffwhittington/repos","events_url":"https://api.github.com/users/geoffwhittington/events{/privacy}","received_events_url":"https://api.github.com/users/geoffwhittington/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-03-01T06:21:15Z","updated_at":"2015-03-04T22:24:38Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/sdelements/lets-chat/pulls/327","html_url":"https://github.com/sdelements/lets-chat/pull/327","diff_url":"https://github.com/sdelements/lets-chat/pull/327.diff","patch_url":"https://github.com/sdelements/lets-chat/pull/327.patch"},"body":"Best practices is to check the `Origin` header: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Checking_The_Origin_Header\r\n\r\nThis PR implements this best practice, if such a header exists, and sends back a `Forbidden` response if its value does not match a white-listed value. The whitelisted value is set in a new setting, `security.serverAuthority`. i.e.\r\n\r\n```\r\nsecurity:\r\n    serverAuthority: 'https://good.server.com:3345/'\r\n```\r\n\r\nEdit: Removed note"},"comment":{"url":"https://api.github.com/repos/sdelements/lets-chat/issues/comments/77263495","html_url":"https://github.com/sdelements/lets-chat/pull/327#issuecomment-77263495","issue_url":"https://api.github.com/repos/sdelements/lets-chat/issues/327","id":77263495,"user":{"login":"geoffwhittington","id":1770544,"avatar_url":"https://avatars.githubusercontent.com/u/1770544?v=3","gravatar_id":"","url":"https://api.github.com/users/geoffwhittington","html_url":"https://github.com/geoffwhittington","followers_url":"https://api.github.com/users/geoffwhittington/followers","following_url":"https://api.github.com/users/geoffwhittington/following{/other_user}","gists_url":"https://api.github.com/users/geoffwhittington/gists{/gist_id}","starred_url":"https://api.github.com/users/geoffwhittington/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/geoffwhittington/subscriptions","organizations_url":"https://api.github.com/users/geoffwhittington/orgs","repos_url":"https://api.github.com/users/geoffwhittington/repos","events_url":"https://api.github.com/users/geoffwhittington/events{/privacy}","received_events_url":"https://api.github.com/users/geoffwhittington/received_events","type":"User","site_admin":false},"created_at":"2015-03-04T22:24:38Z","updated_at":"2015-03-04T22:24:38Z","body":"Thanks @sibartlett \r\nA thing to check is whether stuff works with FireFox, Safari and IE - maybe they send Origin differently?"}}