Add proper security to the apps

[thaalesalves]

Summary

The backend API is currently open and has no security, and that needs to change. With Discord authentication this will be possible. With proper security in the back end, we can store client data more securely and prevent storage of sensitive data in the browser or in a cookie.

Details

The backend API needs to have Authorization headers validation with proper tokens and block the APIs in case a valid session isn't available. Now that we have Discord authentication, we should investigate a way of achieving this. This should also help secure the front end.

• Retrieve authorization and authentication data from Discord API and cache it in the back end;
• Create a custom internal token (UUID or NanoID);
• Use this internal token as the key for caching the actual auth data;
• Return that internal token to the client and have it store it in an encrypted cookie;
• Add Spring Security layers to the REST API so it blocks requests that don't have a valid internal token in the Authorization header;
• Remove requester header (contains user ID an nothing else) from the requests and use cached data instead;

[thaalesalves]

Migrated to JIRA