3 ms·
I've thought about this a lot when building GitHub integrations. It's so so so easy to use a GitHub username or an email as the link to the GitHub account. In f
by hardwaregeek 3y ago
I've thought about this a lot when building GitHub integrations. It's so so so easy to use a GitHub username or an email as the link to the GitHub account. In fact, I don't even know how you connect an account to GitHub in a persistent manner. Email is slightly better because the odds that someone takes a specific email is pretty unlikely, but hey, domains expire too. Does GitHub give you a unique, guaranteed to never change id that corresponds to an account? They should.
- eslaught 3y agoYes: https://api.github.com/users/<userhandle> https://api.github.com/users/<userhandle> From: https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix https://github.com/NixOS/nixpkgs/blob/master/maintainers/mai...
- hardwaregeek 3y agoIs it guaranteed to not change?
- LoganDark 3y agoGitHub user IDs look like "4723091" (there's mine). If you look at the IDs for multiple accounts, you'll very quickly notice that they seem to have been assigned sequentially at registration time. Fairly sure this is a permanent deal.
- hardwaregeek 3y agoWhat's tricky is that GitHub API docs[1] appears to explicitly recommend passing the username and not the ID. Both the GraphQL and the REST versions tell you to get a user by passing a username. [1]: https://docs.github.com/en/rest/users/users?apiVersion=2022-11-28#get-a-user https://docs.github.com/en/rest/users/users?apiVersion=2022-...
- LoganDark 3y agoYeah, they seem really focused on usernames. The sad thing is that you shouldn't just figure out a user-ID-to-username endpoint because that just creates a TOCTOU opportunity. You have to have GitHub accept a user ID directly on the operation you want to perform with that user, or else something could change in between getting the username and operating on that username.
- hardwaregeek 3y agoAfter doing some more research, it really doesn't help that GitHub has a GraphQL query to get a user by login and no obvious query to get a user by ID.