[api] enable CSRF by default

[dpgaspar]

CATEGORY

Choose one

• Bug Fix
• Enhancement (new features, refinement)
• Refactor
• Add tests
• Build / Development Environment
• Documentation

SUMMARY

Enables CSRF on the new REST API by default. Uses Flask-WTF CSRF protection.
Thank you @nytai for helping out on the frontend side.

ADDITIONAL INFORMATION

• Has associated issue:
• Changes UI
• Requires DB Migration.
• Confirm DB Migration upgrade and downgrade tested.
• Introduces new feature or API
• Removes existing feature or API

REVIEWERS

[etr2460]

How does this interact with the current csrf token? Are we sending two down to the client? How do we know which one to use?

[nytai]

@etr2460 Given that FAB/superset supports multiple auth methods there are multiple library's for handling csrf protection on the backend. The one that's on by default is provided by Flask-WTF, this is the one currently used when username/pw auth is configured. When using flask-wtf the csrf if provided via a jinja function (meant to be inserted in the DOM). When using flask-jwt-extended the csrf if provided in a cookie and it should match what's in the jwt payload.

This PR adds functionality to default to using the CSRF token provided by flask-wtf, however if that is disabled (via a config flag) and doesn't exist in the DOM, then we check the presence of the token in the cookie. This allows for both methods of checking CSRF. If both methods are enabled (they shouldn't be) then it'll default to flask-wtf token.