SHIELD-71 SHIELD-78 Modified source of id_token.

[atultherajput]

Signed-off-by: Atul Krishna Atul.Krishna@progress.com

🔩 Description: What code changed, and why?

Removed id_token cookie and changed API flow to retrieve id_token from the HTTP response body.

Currently, the id_token cookie doesn't have Secure and HttpOnly attributes. While it is possible to add the Secure attribute but we cannot add the HttpOnly attribute in the id_token cookie as we are accessing this cookie via javascript to store it in the browser's local storage. Check here for more details.

The proposed solution is to modify the existing sign-in API flow to get id_token from /session/callback API's response body instead of the cookie.

⛓️ Related Resources

https://chefio.atlassian.net/browse/SHIELD-64
https://chefio.atlassian.net/browse/SHIELD-71

#6716

👍 Definition of Done

The /session/callback API should have id_token and state in response body.

👟 How to Build and Test the Change

Pull the changes from the source branch
Start automate
Rebuild session-service
Rebuild automate-dex
Open UI in browser with network tab
Check response of /session/callback API after login. It should have id_token and state value in the response body.

✅ Checklist

All PRs must tick these:

• I have read the CONTRIBUTING document.
• All commits signed-off for the Developer Certification of Origin.

With occasional exceptions, all PRs from Progress employees must tick these:

• Is the code clear? (complicated code or lots of comments--subdivide and use well-named methods, meaningful variable names, etc.)
• Consistency checked? (user notifications, user prompts, visual patterns, code patterns, variable names)
• Repeated code blocks eliminated? (adapt and reuse existing components, blocks, functions, etc.)
• Spelling, grammar, typos checked? (at a minimum use make spell in any component directory)
• Code well-formatted? (indents, line breaks, etc. improve rather than hinder readability)

All PRs from Progress employees should tick these if appropriate:

• Tests added/updated? (all new code needs new tests)
• Docs added/updated? (all customer-facing changes)

Please add a note next to any checkbox above if you are NOT ticking it.

📷 Screenshots, if applicable

Screen.Recording.2022-06-16.at.4.55.59.PM.mov

[netlify]

👷 Deploy Preview for chef-automate processing.

Name	Link
🔨 Latest commit	a83fe5f
🔍 Latest deploy log	https://app.netlify.com/sites/chef-automate/deploys/62b568374001a50009f25d4b

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
1 Code Smell

100.0% Coverage
1.5% Duplication