{"action":"created","issue":{"url":"https://api.github.com/repos/SignalR/SignalR/issues/3841","repository_url":"https://api.github.com/repos/SignalR/SignalR","labels_url":"https://api.github.com/repos/SignalR/SignalR/issues/3841/labels{/name}","comments_url":"https://api.github.com/repos/SignalR/SignalR/issues/3841/comments","events_url":"https://api.github.com/repos/SignalR/SignalR/issues/3841/events","html_url":"https://github.com/SignalR/SignalR/pull/3841","id":202972513,"number":3841,"title":"'signalr/negotiate' CustomAuthorizeAttribute conflicts ","user":{"login":"msx752","id":11164838,"avatar_url":"https://avatars.githubusercontent.com/u/11164838?v=3","gravatar_id":"","url":"https://api.github.com/users/msx752","html_url":"https://github.com/msx752","followers_url":"https://api.github.com/users/msx752/followers","following_url":"https://api.github.com/users/msx752/following{/other_user}","gists_url":"https://api.github.com/users/msx752/gists{/gist_id}","starred_url":"https://api.github.com/users/msx752/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/msx752/subscriptions","organizations_url":"https://api.github.com/users/msx752/orgs","repos_url":"https://api.github.com/users/msx752/repos","events_url":"https://api.github.com/users/msx752/events{/privacy}","received_events_url":"https://api.github.com/users/msx752/received_events","type":"User","site_admin":false},"labels":[{"id":287602941,"url":"https://api.github.com/repos/SignalR/SignalR/labels/cla-not-required","name":"cla-not-required","color":"009800","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-01-24T23:37:00Z","updated_at":"2017-01-24T23:37:04Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/SignalR/SignalR/pulls/3841","html_url":"https://github.com/SignalR/SignalR/pull/3841","diff_url":"https://github.com/SignalR/SignalR/pull/3841.diff","patch_url":"https://github.com/SignalR/SignalR/pull/3841.patch"},"body":"when we use **CustomAuthorizeAttribute** on our signalr server, anybody who call `signalr/negotiate` without parameters(malicious person) can give access from signalr **without visit** the CustomAuthorizeAttribute\r\n\r\n**Examples**\r\n`http://shootr.signalr.net/signalr/negotiate`\r\n**and**\r\n`http://shootr.signalr.net/signalr/negotiate?connectionData=%5B%7B%22name%22%3A%22h%22%7D%5D&clientProtocol=1.3&_=1485297186225`\r\n\r\n- firstone can access without visit CustomAuthorizeAttr and their **\"ProtocolVersion\":\"1.2\"**\r\n- secondone visits to CustomAuthorizeAttr then maybe it can be declined and their **\"ProtocolVersion\":\"1.3\"**\r\n\r\nam i wrong?. Can somebody enlighten me."},"comment":{"url":"https://api.github.com/repos/SignalR/SignalR/issues/comments/274974481","html_url":"https://github.com/SignalR/SignalR/pull/3841#issuecomment-274974481","issue_url":"https://api.github.com/repos/SignalR/SignalR/issues/3841","id":274974481,"user":{"login":"dnfclas","id":10201666,"avatar_url":"https://avatars.githubusercontent.com/u/10201666?v=3","gravatar_id":"","url":"https://api.github.com/users/dnfclas","html_url":"https://github.com/dnfclas","followers_url":"https://api.github.com/users/dnfclas/followers","following_url":"https://api.github.com/users/dnfclas/following{/other_user}","gists_url":"https://api.github.com/users/dnfclas/gists{/gist_id}","starred_url":"https://api.github.com/users/dnfclas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dnfclas/subscriptions","organizations_url":"https://api.github.com/users/dnfclas/orgs","repos_url":"https://api.github.com/users/dnfclas/repos","events_url":"https://api.github.com/users/dnfclas/events{/privacy}","received_events_url":"https://api.github.com/users/dnfclas/received_events","type":"User","site_admin":false},"created_at":"2017-01-24T23:37:04Z","updated_at":"2017-01-24T23:37:04Z","body":"Hi __@msx752__, I'm your friendly neighborhood .NET Foundation Pull Request Bot (You can call me DNFBOT). Thanks for your contribution!\r\n    <span>\r\n        This seems like a small (but important) contribution, so no Contribution License Agreement is required at this point. Real humans will now evaluate your PR.\r\n    </span>\r\n\r\nTTYL, DNFBOT;\r\n"}}
{"actor":{"display_login":"dnfclas"}}