{"action":"created","issue":{"url":"https://api.github.com/repos/nengo/nengo_gui/issues/915","repository_url":"https://api.github.com/repos/nengo/nengo_gui","labels_url":"https://api.github.com/repos/nengo/nengo_gui/issues/915/labels{/name}","comments_url":"https://api.github.com/repos/nengo/nengo_gui/issues/915/comments","events_url":"https://api.github.com/repos/nengo/nengo_gui/issues/915/events","html_url":"https://github.com/nengo/nengo_gui/pull/915","id":261768354,"number":915,"title":"Token based authentication","user":{"login":"jgosmann","id":850157,"avatar_url":"https://avatars3.githubusercontent.com/u/850157?v=4","gravatar_id":"","url":"https://api.github.com/users/jgosmann","html_url":"https://github.com/jgosmann","followers_url":"https://api.github.com/users/jgosmann/followers","following_url":"https://api.github.com/users/jgosmann/following{/other_user}","gists_url":"https://api.github.com/users/jgosmann/gists{/gist_id}","starred_url":"https://api.github.com/users/jgosmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgosmann/subscriptions","organizations_url":"https://api.github.com/users/jgosmann/orgs","repos_url":"https://api.github.com/users/jgosmann/repos","events_url":"https://api.github.com/users/jgosmann/events{/privacy}","received_events_url":"https://api.github.com/users/jgosmann/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-09-29T20:56:18Z","updated_at":"2017-10-24T19:21:42Z","closed_at":null,"author_association":"MEMBER","pull_request":{"url":"https://api.github.com/repos/nengo/nengo_gui/pulls/915","html_url":"https://github.com/nengo/nengo_gui/pull/915","diff_url":"https://github.com/nengo/nengo_gui/pull/915.diff","patch_url":"https://github.com/nengo/nengo_gui/pull/915.patch"},"body":"This resolves some security problems on multi-user systems. Prior to these changes any user on the local system could have connected to the Nengo GUI server to run arbitrary code under the permissions of a different user. With the token based authentication such an evil user has to obtain the token first.\r\n\r\nThis is similar to how Jupyter Notebook handles things.\r\n    \r\nFixes #867. Also fixes some Python 3 issues with the password protection.\r\n\r\nAnother benefit is that this allows to automatically login into a password protected server. Though maybe that might give the impression that the password protection does not work?\r\n\r\nAt the moment the only way to have a Nengo GUI server that listens for outside connections is to spawn a password protected server. I wonder whether we should add the possibility to allow outside connections even without a password as the token based authentication will still be required? If so, should this be restricted to SSL connections? (I think Jupyter Notebook only allows to enable outside connections only together with SSL and it probably makes sense as sniffing the token gives full access.) Of course one could set a password (hopefully secure) dummy password and still use the token ..."},"comment":{"url":"https://api.github.com/repos/nengo/nengo_gui/issues/comments/339102339","html_url":"https://github.com/nengo/nengo_gui/pull/915#issuecomment-339102339","issue_url":"https://api.github.com/repos/nengo/nengo_gui/issues/915","id":339102339,"user":{"login":"jgosmann","id":850157,"avatar_url":"https://avatars3.githubusercontent.com/u/850157?v=4","gravatar_id":"","url":"https://api.github.com/users/jgosmann","html_url":"https://github.com/jgosmann","followers_url":"https://api.github.com/users/jgosmann/followers","following_url":"https://api.github.com/users/jgosmann/following{/other_user}","gists_url":"https://api.github.com/users/jgosmann/gists{/gist_id}","starred_url":"https://api.github.com/users/jgosmann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jgosmann/subscriptions","organizations_url":"https://api.github.com/users/jgosmann/orgs","repos_url":"https://api.github.com/users/jgosmann/repos","events_url":"https://api.github.com/users/jgosmann/events{/privacy}","received_events_url":"https://api.github.com/users/jgosmann/received_events","type":"User","site_admin":false},"created_at":"2017-10-24T19:21:42Z","updated_at":"2017-10-24T19:21:42Z","author_association":"MEMBER","body":"I added a commit to fix #914."}}
{"actor":{"display_login":"jgosmann"}}