Remove support for CSRF tokens

[atruskie]

There is legacy support in the angular app for sending CSRF tokens back to the rails API.

However it seems that CORS support in rails/browsers means we don't need to worry about CSRF tokens anymore.

@cofiem can you confirm the above is accurate?

[cofiem]

I'm really not sure.

Looks like we might need something like OAuth - APIs are still vulnerable. API and UI could use different auth mechanisms. This is not ideal, since then the UI can't use the API for a single page app.

Easiest is to rely on CORS for API and CSRF token for UI. Still potential for CSRF in API. Hardest, but most secure is OAuth for API, where key can be used by UI.

Resources:

• http://stackoverflow.com/questions/24680302/csrf-protection-with-cors-origin-header-vs-csrf-token
• http://www.insinuator.net/2013/08/cross-site-request-forgery-with-cross-origin-resource-sharing/
• https://mathieu.fenniak.net/is-your-web-api-susceptible-to-a-csrf-exploit/
• https://technpol.wordpress.com/2014/04/17/rails4-angularjs-csrf-and-devise/
• http://stackoverflow.com/questions/11845500/rails-devise-authentication-csrf-issue

[atruskie]

The other option is to include the CSRF tokens. Support is already there, just no way to get a token from server at the moment, and not sure of semantics of reusing the token multiple times in concurrent AJAX requests.

[cofiem]

This seems to give the answer: http://stackoverflow.com/questions/7600347/rails-api-design-without-disabling-csrf-protection

In responses to authenticated API requests, include the CSRF token.

This is partially implemented in https://github.com/QutBioacoustics/baw-server/blob/develop/app/controllers/application_controller.rb#L85

Next Steps

Server side:

• Change the server CSRF implementation to include a CSRF token in a cookie named XSRF-TOKEN only for logged in users
• Check that API requests from logged in users include a valid CSRF token in the X-XSRF-TOKEN header

Client Side:

• Angular should get the CSRF token from a cookie named XSRF-TOKEN. It will only be available to logged in users.
• set angular to include the CSRF token in a header named X-XSRF-TOKEN in requests made by logged in users.

[atruskie]

After much debugging and pain, we've decided that an auth token (as opposed to using cookies + xsrf tokens is ideal).

For now, in development mode, only auth tokens will be used.

When deployed to staging / production, angular's is built XSRF token parsing (from cookies) will kick in and also in work in addition to the auth token.