{"action":"closed","issue":{"url":"https://api.github.com/repos/inverse-inc/packetfence/issues/2352","repository_url":"https://api.github.com/repos/inverse-inc/packetfence","labels_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/2352/labels{/name}","comments_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/2352/comments","events_url":"https://api.github.com/repos/inverse-inc/packetfence/issues/2352/events","html_url":"https://github.com/inverse-inc/packetfence/issues/2352","id":231450926,"number":2352,"title":"Web-authentication session leak","user":{"login":"julsemaan","id":3857942,"avatar_url":"https://avatars2.githubusercontent.com/u/3857942?v=3","gravatar_id":"","url":"https://api.github.com/users/julsemaan","html_url":"https://github.com/julsemaan","followers_url":"https://api.github.com/users/julsemaan/followers","following_url":"https://api.github.com/users/julsemaan/following{/other_user}","gists_url":"https://api.github.com/users/julsemaan/gists{/gist_id}","starred_url":"https://api.github.com/users/julsemaan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/julsemaan/subscriptions","organizations_url":"https://api.github.com/users/julsemaan/orgs","repos_url":"https://api.github.com/users/julsemaan/repos","events_url":"https://api.github.com/users/julsemaan/events{/privacy}","received_events_url":"https://api.github.com/users/julsemaan/received_events","type":"User","site_admin":false},"labels":[{"id":586476,"url":"https://api.github.com/repos/inverse-inc/packetfence/labels/bug","name":"bug","color":"fc2929","default":true},{"id":612527622,"url":"https://api.github.com/repos/inverse-inc/packetfence/labels/for%20tracking","name":"for tracking","color":"5319e7","default":false},{"id":198138648,"url":"https://api.github.com/repos/inverse-inc/packetfence/labels/zammitbug","name":"zammitbug","color":"d4c5f9","default":false}],"state":"closed","locked":false,"assignee":{"login":"julsemaan","id":3857942,"avatar_url":"https://avatars2.githubusercontent.com/u/3857942?v=3","gravatar_id":"","url":"https://api.github.com/users/julsemaan","html_url":"https://github.com/julsemaan","followers_url":"https://api.github.com/users/julsemaan/followers","following_url":"https://api.github.com/users/julsemaan/following{/other_user}","gists_url":"https://api.github.com/users/julsemaan/gists{/gist_id}","starred_url":"https://api.github.com/users/julsemaan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/julsemaan/subscriptions","organizations_url":"https://api.github.com/users/julsemaan/orgs","repos_url":"https://api.github.com/users/julsemaan/repos","events_url":"https://api.github.com/users/julsemaan/events{/privacy}","received_events_url":"https://api.github.com/users/julsemaan/received_events","type":"User","site_admin":false},"assignees":[{"login":"julsemaan","id":3857942,"avatar_url":"https://avatars2.githubusercontent.com/u/3857942?v=3","gravatar_id":"","url":"https://api.github.com/users/julsemaan","html_url":"https://github.com/julsemaan","followers_url":"https://api.github.com/users/julsemaan/followers","following_url":"https://api.github.com/users/julsemaan/following{/other_user}","gists_url":"https://api.github.com/users/julsemaan/gists{/gist_id}","starred_url":"https://api.github.com/users/julsemaan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/julsemaan/subscriptions","organizations_url":"https://api.github.com/users/julsemaan/orgs","repos_url":"https://api.github.com/users/julsemaan/repos","events_url":"https://api.github.com/users/julsemaan/events{/privacy}","received_events_url":"https://api.github.com/users/julsemaan/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/inverse-inc/packetfence/milestones/20","html_url":"https://github.com/inverse-inc/packetfence/milestone/20","labels_url":"https://api.github.com/repos/inverse-inc/packetfence/milestones/20/labels","id":1869064,"number":20,"title":"+1 (patch release)","description":"DO NOT DELETE / CLOSE\r\nMETA milestone used to track what should go in the next \"patch\" release (X.X.Y) (in this case, Y is the \"patch\" release)\r\nCan be used to decide whether or not to do a \"patch\" release.\r\n","creator":{"login":"dwlfrth","id":633234,"avatar_url":"https://avatars2.githubusercontent.com/u/633234?v=3","gravatar_id":"","url":"https://api.github.com/users/dwlfrth","html_url":"https://github.com/dwlfrth","followers_url":"https://api.github.com/users/dwlfrth/followers","following_url":"https://api.github.com/users/dwlfrth/following{/other_user}","gists_url":"https://api.github.com/users/dwlfrth/gists{/gist_id}","starred_url":"https://api.github.com/users/dwlfrth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dwlfrth/subscriptions","organizations_url":"https://api.github.com/users/dwlfrth/orgs","repos_url":"https://api.github.com/users/dwlfrth/repos","events_url":"https://api.github.com/users/dwlfrth/events{/privacy}","received_events_url":"https://api.github.com/users/dwlfrth/received_events","type":"User","site_admin":false},"open_issues":8,"closed_issues":107,"state":"open","created_at":"2016-07-07T02:51:35Z","updated_at":"2017-05-29T15:52:43Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2017-05-25T20:31:39Z","updated_at":"2017-05-29T15:52:43Z","closed_at":"2017-05-29T15:52:43Z","body":"When creating a web-authentication session (using pf::Portal::Session), then if the endpoint doesn't reuse the session ID we gave him in the next requests, we will create a session for nothing. This is especially damageable when a device hammers the portal with multiple web-auth redirect requests per second which may end up taking a lot of place in the redis instance\r\n\r\nWe should make this session use a MAC based session ID so its consistently tied to the device even though it doesn't reuse its session ID"}}
{"actor":{"display_login":"julsemaan"}}