Reduce frequency of CSRF Tokens being refreshed/reset

[tdonohue]

References

Loosely related to DSpace/dspace-angular#1024 , but both PRs are standalone and not dependent on one another

Description

While testing batch uploads (see DSpace/dspace-angular#1024), I realized that the CSRF token is being refreshed/changed every time it is used. This means it refreshes on every POST/PUT/PATCH/DELETE request. While this seemed like a good idea in initial implementation, it now seems potentially problematic / complex for batch operations.

The reason is that during a batch upload, the CSRF token can change between every uploaded file (when each file is sent as a separate request). This can be difficult on the client side to achieve/manage, as any batch operations need to carefully monitor the CSRF Token.

It also runs the risk of an (unproven) possible "race" condition: If the client sends the next request before or while reading the response of the last one & that response changes the CSRF token, then the "next request" may include an outdated CSRF token (causing a 403 error).

So, this PR changes the logic so that CSRF Tokens are only reset/refreshed in the following scenarios:

• Anytime your AuthToken changes, e.g. during Login/Logout. This is more in line with when Spring Security defaults to changing the CSRF token...see for example their CsrfAuthenticationStrategy
• If the CSRF Token was sent by the client to the server via a querystring or form parameter (as these parameters can be easily read by a third party & therefore are less secure)
• If an InvalidCsrfTokenException occurs, as this means the client sent an invalid CSRF token to the server. So, the server should invalidate and send a new one (allowing the client to resync its CSRF token). This scenario is not covered in this PR, as it is already in the codebase in DSpaceAccessDeniedHandler

Instructions for Reviewers

• Review code & new tests to prove the new scenarios are working as expected.
  • NOTE: I also updated/added JavaDocs to RestAuthenticationService to make these changes easier to understand.
• Attempt login & logout via Angular UI or Hal Browse and verify the CSRF Token changes. Verify also that other operations (e.g. editing an Item or starting a new Submission) do not change the CSRF Token
  • This is easiest to verify from the Angular UI by opening Chrome DevTools and watching the Cookies in the "Application" tab, verifying the XSRF-TOKEN cookie updates after login & logout, but not during other operations.

[abollini]

hi @tdonohue I have put a question inline, can you help me to understand the code?

[tdonohue]

@abollini : I've responded to your questions above. As noted in those responses, I don't think there's any code changes necessary for this PR, but let me know if you disagree.

[abollini]

I'm ok with the improvement that you have suggested, +1 to merge