Lock down cookie based authentication on API endpoints

[amercader]

Discussed on 2022-08-23 dev meeting:

1. Default behaviour: discard cookie based authentication in the API if it doesn't include the CSRF token
   • Is this equivalent to remove the @csrf.exempt decorator here?
2. Add new configuration option: turn off entirely cookie based authentication on the API endpoint
   • Not sure how to implement this, but probably we need to fiddle at the Flask-login level. Maybe this is helpful?
3. (Optional): Allow cookie based authentication without valid CSRF tokens on development mode

@wardi @EricSoroos did I capture that correctly?

[amercader]

@TomeCirun you were kindly volunteered to work on this by @tino097 :)

Let's start with the first point. I think what we need to do is:

1. Remove the @csrf.exempt check from the API action endpoint. This will cause all client side JS API calls to fail, so
2. We need to update the JS calls to include the CSRF header, like you did for the follow module on [#6158] Add CSRF Protection #6863 . Remember to move the addCsrfTokenHeader() function to the base module class. Or maybe we even don't have to change any modules and just modify the client class they use to add the header
3. Document the behaviour change (No cookie based authentication in the API without CSRF token) and the changes needed in JS if they are not using the ckan client

Does this make sense?