{"action":"closed","number":14,"pull_request":{"url":"https://api.github.com/repos/mevdschee/php-api-auth/pulls/14","id":108947479,"html_url":"https://github.com/mevdschee/php-api-auth/pull/14","diff_url":"https://github.com/mevdschee/php-api-auth/pull/14.diff","patch_url":"https://github.com/mevdschee/php-api-auth/pull/14.patch","issue_url":"https://api.github.com/repos/mevdschee/php-api-auth/issues/14","number":14,"state":"closed","locked":false,"title":"csrf token creation max int","user":{"login":"VyseExhale","id":4747818,"avatar_url":"https://avatars1.githubusercontent.com/u/4747818?v=3","gravatar_id":"","url":"https://api.github.com/users/VyseExhale","html_url":"https://github.com/VyseExhale","followers_url":"https://api.github.com/users/VyseExhale/followers","following_url":"https://api.github.com/users/VyseExhale/following{/other_user}","gists_url":"https://api.github.com/users/VyseExhale/gists{/gist_id}","starred_url":"https://api.github.com/users/VyseExhale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/VyseExhale/subscriptions","organizations_url":"https://api.github.com/users/VyseExhale/orgs","repos_url":"https://api.github.com/users/VyseExhale/repos","events_url":"https://api.github.com/users/VyseExhale/events{/privacy}","received_events_url":"https://api.github.com/users/VyseExhale/received_events","type":"User","site_admin":false},"body":"I found an issue handling the csrf token in javascript.\r\n\r\nIn my JS application I am loggin in by firing a $.ajax({type:'json}); post request to the api. \r\nIn the request result I see this csrf: 233560806887784448\r\nBut $.ajax({type: \"json\"}) auto-parses the result using JSON.parse(); so in JS my csrf resulted in 233560806887784450\r\n\r\nI found out that JS has a MAX_SAFE_INTEGER constant of value of 9007199254740991. [The reasoning behind that number is that JavaScript uses double-precision floating-point format numbers as specified in IEEE 754](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number/MAX_SAFE_INTEGER)\r\n\r\nI am getting this error because my webserver PHP_INT_MAX is 9223372036854775807 which is much higher than the js MAX_SAFE_INTEGER. resulting in a bad csrf token on the js side.\r\n\r\nTo solve this, I have 3 options.\r\n\r\n1) I could change my web server PHP_INT_MAX value to a lower acceptable value. But then some other webhosting poviders do not allow me to reassign the PHP_INT_MAX value.\r\n\r\n2) In my js application I set the $.ajax type to \"text\" preventing $ to parse the server response with JSON.parse(). This would only work if the js application and the api are hosted on the same domain. In my case it's not so I need to set the type to json, now jquery will convert the request to a jsonp which is required for Cross-domain requests.\r\n\r\nLeaves me to this solution, editing the php-auth-api and do something like this:\r\n```php\r\nif (!isset($_SESSION['csrf'])) {\r\n   $jsMax = 9007199254740992; // largest nr in JS\r\n   $max = (PHP_INT_MAX > $jsMax) ? $jsMax : PHP_INT_MAX ;\r\n   if (function_exists('random_int')) $_SESSION['csrf'] = (string)random_int(0, $max);\r\n   else $_SESSION['csrf'] = (string)rand(0, $max);\r\n}\r\n```","created_at":"2017-03-03T10:39:34Z","updated_at":"2017-03-03T11:37:06Z","closed_at":"2017-03-03T11:37:06Z","merged_at":"2017-03-03T11:37:06Z","merge_commit_sha":"97fdc6ac42e8936ec26ad7d643c46f22c28b6548","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/mevdschee/php-api-auth/pulls/14/commits","review_comments_url":"https://api.github.com/repos/mevdschee/php-api-auth/pulls/14/comments","review_comment_url":"https://api.github.com/repos/mevdschee/php-api-auth/pulls/comments{/number}","comments_url":"https://api.github.com/repos/mevdschee/php-api-auth/issues/14/comments","statuses_url":"https://api.github.com/repos/mevdschee/php-api-auth/statuses/addf69bcf3466ca8b70741639d992cf8f04c17bd","head":{"label":"VyseExhale:patch-1","ref":"patch-1","sha":"addf69bcf3466ca8b70741639d992cf8f04c17bd","user":{"login":"VyseExhale","id":4747818,"avatar_url":"https://avatars1.githubusercontent.com/u/4747818?v=3","gravatar_id":"","url":"https://api.github.com/users/VyseExhale","html_url":"https://github.com/VyseExhale","followers_url":"https://api.github.com/users/VyseExhale/followers","following_url":"https://api.github.com/users/VyseExhale/following{/other_user}","gists_url":"https://api.github.com/users/VyseExhale/gists{/gist_id}","starred_url":"https://api.github.com/users/VyseExhale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/VyseExhale/subscriptions","organizations_url":"https://api.github.com/users/VyseExhale/orgs","repos_url":"https://api.github.com/users/VyseExhale/repos","events_url":"https://api.github.com/users/VyseExhale/events{/privacy}","received_events_url":"https://api.github.com/users/VyseExhale/received_events","type":"User","site_admin":false},"repo":{"id":83785094,"name":"php-api-auth","full_name":"VyseExhale/php-api-auth","owner":{"login":"VyseExhale","id":4747818,"avatar_url":"https://avatars1.githubusercontent.com/u/4747818?v=3","gravatar_id":"","url":"https://api.github.com/users/VyseExhale","html_url":"https://github.com/VyseExhale","followers_url":"https://api.github.com/users/VyseExhale/followers","following_url":"https://api.github.com/users/VyseExhale/following{/other_user}","gists_url":"https://api.github.com/users/VyseExhale/gists{/gist_id}","starred_url":"https://api.github.com/users/VyseExhale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/VyseExhale/subscriptions","organizations_url":"https://api.github.com/users/VyseExhale/orgs","repos_url":"https://api.github.com/users/VyseExhale/repos","events_url":"https://api.github.com/users/VyseExhale/events{/privacy}","received_events_url":"https://api.github.com/users/VyseExhale/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/VyseExhale/php-api-auth","description":"Single file PHP script that adds authentication to a PHP-CRUD-API project","fork":true,"url":"https://api.github.com/repos/VyseExhale/php-api-auth","forks_url":"https://api.github.com/repos/VyseExhale/php-api-auth/forks","keys_url":"https://api.github.com/repos/VyseExhale/php-api-auth/keys{/key_id}","collaborators_url":"https://api.github.com/repos/VyseExhale/php-api-auth/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/VyseExhale/php-api-auth/teams","hooks_url":"https://api.github.com/repos/VyseExhale/php-api-auth/hooks","issue_events_url":"https://api.github.com/repos/VyseExhale/php-api-auth/issues/events{/number}","events_url":"https://api.github.com/repos/VyseExhale/php-api-auth/events","assignees_url":"https://api.github.com/repos/VyseExhale/php-api-auth/assignees{/user}","branches_url":"https://api.github.com/repos/VyseExhale/php-api-auth/branches{/branch}","tags_url":"https://api.github.com/repos/VyseExhale/php-api-auth/tags","blobs_url":"https://api.github.com/repos/VyseExhale/php-api-auth/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/VyseExhale/php-api-auth/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/VyseExhale/php-api-auth/git/refs{/sha}","trees_url":"https://api.github.com/repos/VyseExhale/php-api-auth/git/trees{/sha}","statuses_url":"https://api.github.com/repos/VyseExhale/php-api-auth/statuses/{sha}","languages_url":"https://api.github.com/repos/VyseExhale/php-api-auth/languages","stargazers_url":"https://api.github.com/repos/VyseExhale/php-api-auth/stargazers","contributors_url":"https://api.github.com/repos/VyseExhale/php-api-auth/contributors","subscribers_url":"https://api.github.com/repos/VyseExhale/php-api-auth/subscribers","subscription_url":"https://api.github.com/repos/VyseExhale/php-api-auth/subscription","commits_url":"https://api.github.com/repos/VyseExhale/php-api-auth/commits{/sha}","git_commits_url":"https://api.github.com/repos/VyseExhale/php-api-auth/git/commits{/sha}","comments_url":"https://api.github.com/repos/VyseExhale/php-api-auth/comments{/number}","issue_comment_url":"https://api.github.com/repos/VyseExhale/php-api-auth/issues/comments{/number}","contents_url":"https://api.github.com/repos/VyseExhale/php-api-auth/contents/{+path}","compare_url":"https://api.github.com/repos/VyseExhale/php-api-auth/compare/{base}...{head}","merges_url":"https://api.github.com/repos/VyseExhale/php-api-auth/merges","archive_url":"https://api.github.com/repos/VyseExhale/php-api-auth/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/VyseExhale/php-api-auth/downloads","issues_url":"https://api.github.com/repos/VyseExhale/php-api-auth/issues{/number}","pulls_url":"https://api.github.com/repos/VyseExhale/php-api-auth/pulls{/number}","milestones_url":"https://api.github.com/repos/VyseExhale/php-api-auth/milestones{/number}","notifications_url":"https://api.github.com/repos/VyseExhale/php-api-auth/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/VyseExhale/php-api-auth/labels{/name}","releases_url":"https://api.github.com/repos/VyseExhale/php-api-auth/releases{/id}","deployments_url":"https://api.github.com/repos/VyseExhale/php-api-auth/deployments","created_at":"2017-03-03T10:07:47Z","updated_at":"2017-03-03T10:07:49Z","pushed_at":"2017-03-03T11:36:58Z","git_url":"git://github.com/VyseExhale/php-api-auth.git","ssh_url":"git@github.com:VyseExhale/php-api-auth.git","clone_url":"https://github.com/VyseExhale/php-api-auth.git","svn_url":"https://github.com/VyseExhale/php-api-auth","homepage":"","size":25,"stargazers_count":0,"watchers_count":0,"language":"PHP","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"mevdschee:master","ref":"master","sha":"b5f0f8c0e131e57fa1b8ba02d204c670b6e8eb96","user":{"login":"mevdschee","id":1288217,"avatar_url":"https://avatars0.githubusercontent.com/u/1288217?v=3","gravatar_id":"","url":"https://api.github.com/users/mevdschee","html_url":"https://github.com/mevdschee","followers_url":"https://api.github.com/users/mevdschee/followers","following_url":"https://api.github.com/users/mevdschee/following{/other_user}","gists_url":"https://api.github.com/users/mevdschee/gists{/gist_id}","starred_url":"https://api.github.com/users/mevdschee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mevdschee/subscriptions","organizations_url":"https://api.github.com/users/mevdschee/orgs","repos_url":"https://api.github.com/users/mevdschee/repos","events_url":"https://api.github.com/users/mevdschee/events{/privacy}","received_events_url":"https://api.github.com/users/mevdschee/received_events","type":"User","site_admin":false},"repo":{"id":65614899,"name":"php-api-auth","full_name":"mevdschee/php-api-auth","owner":{"login":"mevdschee","id":1288217,"avatar_url":"https://avatars0.githubusercontent.com/u/1288217?v=3","gravatar_id":"","url":"https://api.github.com/users/mevdschee","html_url":"https://github.com/mevdschee","followers_url":"https://api.github.com/users/mevdschee/followers","following_url":"https://api.github.com/users/mevdschee/following{/other_user}","gists_url":"https://api.github.com/users/mevdschee/gists{/gist_id}","starred_url":"https://api.github.com/users/mevdschee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mevdschee/subscriptions","organizations_url":"https://api.github.com/users/mevdschee/orgs","repos_url":"https://api.github.com/users/mevdschee/repos","events_url":"https://api.github.com/users/mevdschee/events{/privacy}","received_events_url":"https://api.github.com/users/mevdschee/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mevdschee/php-api-auth","description":"Single file PHP script that adds authentication to a PHP-CRUD-API project","fork":false,"url":"https://api.github.com/repos/mevdschee/php-api-auth","forks_url":"https://api.github.com/repos/mevdschee/php-api-auth/forks","keys_url":"https://api.github.com/repos/mevdschee/php-api-auth/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mevdschee/php-api-auth/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mevdschee/php-api-auth/teams","hooks_url":"https://api.github.com/repos/mevdschee/php-api-auth/hooks","issue_events_url":"https://api.github.com/repos/mevdschee/php-api-auth/issues/events{/number}","events_url":"https://api.github.com/repos/mevdschee/php-api-auth/events","assignees_url":"https://api.github.com/repos/mevdschee/php-api-auth/assignees{/user}","branches_url":"https://api.github.com/repos/mevdschee/php-api-auth/branches{/branch}","tags_url":"https://api.github.com/repos/mevdschee/php-api-auth/tags","blobs_url":"https://api.github.com/repos/mevdschee/php-api-auth/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mevdschee/php-api-auth/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mevdschee/php-api-auth/git/refs{/sha}","trees_url":"https://api.github.com/repos/mevdschee/php-api-auth/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mevdschee/php-api-auth/statuses/{sha}","languages_url":"https://api.github.com/repos/mevdschee/php-api-auth/languages","stargazers_url":"https://api.github.com/repos/mevdschee/php-api-auth/stargazers","contributors_url":"https://api.github.com/repos/mevdschee/php-api-auth/contributors","subscribers_url":"https://api.github.com/repos/mevdschee/php-api-auth/subscribers","subscription_url":"https://api.github.com/repos/mevdschee/php-api-auth/subscription","commits_url":"https://api.github.com/repos/mevdschee/php-api-auth/commits{/sha}","git_commits_url":"https://api.github.com/repos/mevdschee/php-api-auth/git/commits{/sha}","comments_url":"https://api.github.com/repos/mevdschee/php-api-auth/comments{/number}","issue_comment_url":"https://api.github.com/repos/mevdschee/php-api-auth/issues/comments{/number}","contents_url":"https://api.github.com/repos/mevdschee/php-api-auth/contents/{+path}","compare_url":"https://api.github.com/repos/mevdschee/php-api-auth/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mevdschee/php-api-auth/merges","archive_url":"https://api.github.com/repos/mevdschee/php-api-auth/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mevdschee/php-api-auth/downloads","issues_url":"https://api.github.com/repos/mevdschee/php-api-auth/issues{/number}","pulls_url":"https://api.github.com/repos/mevdschee/php-api-auth/pulls{/number}","milestones_url":"https://api.github.com/repos/mevdschee/php-api-auth/milestones{/number}","notifications_url":"https://api.github.com/repos/mevdschee/php-api-auth/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mevdschee/php-api-auth/labels{/name}","releases_url":"https://api.github.com/repos/mevdschee/php-api-auth/releases{/id}","deployments_url":"https://api.github.com/repos/mevdschee/php-api-auth/deployments","created_at":"2016-08-13T11:49:51Z","updated_at":"2017-02-10T23:08:28Z","pushed_at":"2017-03-03T11:37:06Z","git_url":"git://github.com/mevdschee/php-api-auth.git","ssh_url":"git@github.com:mevdschee/php-api-auth.git","clone_url":"https://github.com/mevdschee/php-api-auth.git","svn_url":"https://github.com/mevdschee/php-api-auth","homepage":"","size":25,"stargazers_count":28,"watchers_count":28,"language":"PHP","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":25,"mirror_url":null,"open_issues_count":1,"forks":25,"open_issues":1,"watchers":28,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mevdschee/php-api-auth/pulls/14"},"html":{"href":"https://github.com/mevdschee/php-api-auth/pull/14"},"issue":{"href":"https://api.github.com/repos/mevdschee/php-api-auth/issues/14"},"comments":{"href":"https://api.github.com/repos/mevdschee/php-api-auth/issues/14/comments"},"review_comments":{"href":"https://api.github.com/repos/mevdschee/php-api-auth/pulls/14/comments"},"review_comment":{"href":"https://api.github.com/repos/mevdschee/php-api-auth/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/mevdschee/php-api-auth/pulls/14/commits"},"statuses":{"href":"https://api.github.com/repos/mevdschee/php-api-auth/statuses/addf69bcf3466ca8b70741639d992cf8f04c17bd"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"mevdschee","id":1288217,"avatar_url":"https://avatars0.githubusercontent.com/u/1288217?v=3","gravatar_id":"","url":"https://api.github.com/users/mevdschee","html_url":"https://github.com/mevdschee","followers_url":"https://api.github.com/users/mevdschee/followers","following_url":"https://api.github.com/users/mevdschee/following{/other_user}","gists_url":"https://api.github.com/users/mevdschee/gists{/gist_id}","starred_url":"https://api.github.com/users/mevdschee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mevdschee/subscriptions","organizations_url":"https://api.github.com/users/mevdschee/orgs","repos_url":"https://api.github.com/users/mevdschee/repos","events_url":"https://api.github.com/users/mevdschee/events{/privacy}","received_events_url":"https://api.github.com/users/mevdschee/received_events","type":"User","site_admin":false},"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":2,"additions":0,"deletions":0,"changed_files":0}}
{"actor":{"display_login":"mevdschee"}}