pubsubhubbub/PubSubHubbub — Issue #13: Retain hub.verify_token
Author: evanp
Created: 2012-02-24 19:04:06+00:00
State: open

I think it's a mistake to remove the hub.verify_token parameter.

This identifier lets a subscriber know that the caller who's verifying a subscription is the same party they asked for a subscription in the first place.

An attacker could test a subscription callback URL to see if there are outstanding subscription requests for a list of well-known topics, and if any of them are a "hit", it could start sending false or abusive updates to the callback.