{"action":"closed","issue":{"url":"https://api.github.com/repos/zsck/miru/issues/10","repository_url":"https://api.github.com/repos/zsck/miru","labels_url":"https://api.github.com/repos/zsck/miru/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/zsck/miru/issues/10/comments","events_url":"https://api.github.com/repos/zsck/miru/issues/10/events","html_url":"https://github.com/zsck/miru/issues/10","id":208660536,"number":10,"title":"Implement User Registration and Authentication","user":{"login":"zsck","id":682761,"avatar_url":"https://avatars1.githubusercontent.com/u/682761?v=3","gravatar_id":"","url":"https://api.github.com/users/zsck","html_url":"https://github.com/zsck","followers_url":"https://api.github.com/users/zsck/followers","following_url":"https://api.github.com/users/zsck/following{/other_user}","gists_url":"https://api.github.com/users/zsck/gists{/gist_id}","starred_url":"https://api.github.com/users/zsck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zsck/subscriptions","organizations_url":"https://api.github.com/users/zsck/orgs","repos_url":"https://api.github.com/users/zsck/repos","events_url":"https://api.github.com/users/zsck/events{/privacy}","received_events_url":"https://api.github.com/users/zsck/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"zsck","id":682761,"avatar_url":"https://avatars1.githubusercontent.com/u/682761?v=3","gravatar_id":"","url":"https://api.github.com/users/zsck","html_url":"https://github.com/zsck","followers_url":"https://api.github.com/users/zsck/followers","following_url":"https://api.github.com/users/zsck/following{/other_user}","gists_url":"https://api.github.com/users/zsck/gists{/gist_id}","starred_url":"https://api.github.com/users/zsck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zsck/subscriptions","organizations_url":"https://api.github.com/users/zsck/orgs","repos_url":"https://api.github.com/users/zsck/repos","events_url":"https://api.github.com/users/zsck/events{/privacy}","received_events_url":"https://api.github.com/users/zsck/received_events","type":"User","site_admin":false},"assignees":[{"login":"zsck","id":682761,"avatar_url":"https://avatars1.githubusercontent.com/u/682761?v=3","gravatar_id":"","url":"https://api.github.com/users/zsck","html_url":"https://github.com/zsck","followers_url":"https://api.github.com/users/zsck/followers","following_url":"https://api.github.com/users/zsck/following{/other_user}","gists_url":"https://api.github.com/users/zsck/gists{/gist_id}","starred_url":"https://api.github.com/users/zsck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zsck/subscriptions","organizations_url":"https://api.github.com/users/zsck/orgs","repos_url":"https://api.github.com/users/zsck/repos","events_url":"https://api.github.com/users/zsck/events{/privacy}","received_events_url":"https://api.github.com/users/zsck/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/zsck/miru/milestones/1","html_url":"https://github.com/zsck/miru/milestone/1","labels_url":"https://api.github.com/repos/zsck/miru/milestones/1/labels","id":2332095,"number":1,"title":"Version 1.0","description":"A first usable version of miru that we can reliably deploy. Basic expected features include the following.\r\n\r\n1. Show some basic information about the project in a couple of pages.\r\n2. Build registration features for archivers (regular users) and admins (\"lieutenants\").\r\n3. Build report feature that users can inform us of sites that need monitoring.\r\n4. Build an admin portal that can be used to:\r\n    1. See and approve/reject reports (see step 3) of new sites to have monitored.\r\n    2. See what sites are already being monitored.\r\n    3. See a stream of changes detected on monitored websites.","creator":{"login":"zsck","id":682761,"avatar_url":"https://avatars1.githubusercontent.com/u/682761?v=3","gravatar_id":"","url":"https://api.github.com/users/zsck","html_url":"https://github.com/zsck","followers_url":"https://api.github.com/users/zsck/followers","following_url":"https://api.github.com/users/zsck/following{/other_user}","gists_url":"https://api.github.com/users/zsck/gists{/gist_id}","starred_url":"https://api.github.com/users/zsck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zsck/subscriptions","organizations_url":"https://api.github.com/users/zsck/orgs","repos_url":"https://api.github.com/users/zsck/repos","events_url":"https://api.github.com/users/zsck/events{/privacy}","received_events_url":"https://api.github.com/users/zsck/received_events","type":"User","site_admin":false},"open_issues":4,"closed_issues":16,"state":"open","created_at":"2017-02-18T18:02:42Z","updated_at":"2017-03-05T21:44:02Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2017-02-18T18:36:30Z","updated_at":"2017-03-05T21:44:02Z","closed_at":"2017-03-05T21:44:02Z","body":"Users need to be able to register and log into the application to be able to report sites for monitoring. Some basic requirements for this are:\r\n\r\n1. Secure registration submission over HTTPS, which can be setup with [Let's Encrypt](https://letsencrypt.org/).\r\n2. Secure [password hashing](https://github.com/StratumSecurity/scryptauth).\r\n3. Secure login form submission over HTTPS.\r\n4. Secure session management.\r\n    * Strong random session tokens (16 or 32 random bytes, encoded as hex)\r\n    * Avoid [session fixation](https://www.owasp.org/index.php/Session_fixation) with expiration times.\r\n    * Store session tokens in a [secure browser cookie](https://en.wikipedia.org/wiki/Secure_cookies)\r\n\r\nAlso note that we should follow the usual advice and:\r\n\r\n1. Check the origin of requests.\r\n2. Submit secure [Anti Cross-Site Request Forgery](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#General_Recommendations_For_Automated_CSRF_Defense) tokens."}}
{"actor":{"display_login":"zsck"}}