{"action":"created","issue":{"url":"https://api.github.com/repos/thecodingmachine/csrf-header-check-middleware/issues/1","repository_url":"https://api.github.com/repos/thecodingmachine/csrf-header-check-middleware","labels_url":"https://api.github.com/repos/thecodingmachine/csrf-header-check-middleware/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/thecodingmachine/csrf-header-check-middleware/issues/1/comments","events_url":"https://api.github.com/repos/thecodingmachine/csrf-header-check-middleware/issues/1/events","html_url":"https://github.com/thecodingmachine/csrf-header-check-middleware/pull/1","id":234863204,"number":1,"title":"[WIP] Improvements","user":{"login":"moufmouf","id":1290952,"avatar_url":"https://avatars2.githubusercontent.com/u/1290952?v=3","gravatar_id":"","url":"https://api.github.com/users/moufmouf","html_url":"https://github.com/moufmouf","followers_url":"https://api.github.com/users/moufmouf/followers","following_url":"https://api.github.com/users/moufmouf/following{/other_user}","gists_url":"https://api.github.com/users/moufmouf/gists{/gist_id}","starred_url":"https://api.github.com/users/moufmouf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moufmouf/subscriptions","organizations_url":"https://api.github.com/users/moufmouf/orgs","repos_url":"https://api.github.com/users/moufmouf/repos","events_url":"https://api.github.com/users/moufmouf/events{/privacy}","received_events_url":"https://api.github.com/users/moufmouf/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2017-06-09T15:31:38Z","updated_at":"2017-06-11T15:51:34Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/thecodingmachine/csrf-header-check-middleware/pulls/1","html_url":"https://github.com/thecodingmachine/csrf-header-check-middleware/pull/1","diff_url":"https://github.com/thecodingmachine/csrf-header-check-middleware/pull/1.diff","patch_url":"https://github.com/thecodingmachine/csrf-header-check-middleware/pull/1.patch"},"body":"Following comments by @Ocramius, this PR:\r\n\r\n- puts the logic of checking whether the request must be validated or not behind a separate interface (`IsSafeHttpRequestInterface`)\r\n- checks all requests that are not in a whitelist (GET / HEAD / OPTIONS) rather that applying a less secure blacklist\r\n- makes the code easier to read using early return statements (don't know why I did not use those upfront!)\r\n\r\nAlso, this PR:\r\n\r\n- adds ways to bypass the CSRF check \r\n    - by route\r\n    - by using a special request attribute\r\n\r\nTODO before merging:\r\n\r\n- [ ] make sure that the \"X-Forwarded-Host\" header cannot be set from the browser. Otherwise, we need to add an additional parameter to the middleware to decide whether we should look at this parameter (if it was added by a reverse-proxy) or whether we should ignore it (if we are facing the open internet directly)"},"comment":{"url":"https://api.github.com/repos/thecodingmachine/csrf-header-check-middleware/issues/comments/307638098","html_url":"https://github.com/thecodingmachine/csrf-header-check-middleware/pull/1#issuecomment-307638098","issue_url":"https://api.github.com/repos/thecodingmachine/csrf-header-check-middleware/issues/1","id":307638098,"user":{"login":"moufmouf","id":1290952,"avatar_url":"https://avatars2.githubusercontent.com/u/1290952?v=3","gravatar_id":"","url":"https://api.github.com/users/moufmouf","html_url":"https://github.com/moufmouf","followers_url":"https://api.github.com/users/moufmouf/followers","following_url":"https://api.github.com/users/moufmouf/following{/other_user}","gists_url":"https://api.github.com/users/moufmouf/gists{/gist_id}","starred_url":"https://api.github.com/users/moufmouf/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moufmouf/subscriptions","organizations_url":"https://api.github.com/users/moufmouf/orgs","repos_url":"https://api.github.com/users/moufmouf/repos","events_url":"https://api.github.com/users/moufmouf/events{/privacy}","received_events_url":"https://api.github.com/users/moufmouf/received_events","type":"User","site_admin":false},"created_at":"2017-06-11T15:51:34Z","updated_at":"2017-06-11T15:51:34Z","body":"> since this is the first patch, I strongly suggest adding humbug too\r\n\r\nDone.\r\nGood advice! Especially when dealing with something security related."}}
{"actor":{"display_login":"moufmouf"}}