Add session-based auth flow

[binal-7span]

This PR contains the session start and session stop API.

Closes #1263, see https://github.com/directus/api/wiki/Session-Auth-Flow

[rijkvanzanten]

Could you explain what made you choose for this cipher method specifically? I'd like to document all this info as best I can

[binal-7span]

We require the cipher method which can be used for encryption as well as decryption. And this is one of them.

[rijkvanzanten]

Does this mean that looking in with the cookie doesn't have support for 2fa?

[rijkvanzanten]

Can we add HttpOnly to this to make sure JS can't read it?

Also, should we add Expires to this so we can set "auto logout" based on the value in directus_settings?

[binal-7span]

Will do it.

[rijkvanzanten]

Does this remove the cookie from the browser or will it only respond once without the cookie?

[binal-7span]

It only responds without the cookie. But if the user tried to use that cookie then the server will throw the error.

[rijkvanzanten]

@bjgajjar Could you maybe provide a tiny working example in browser-javascript?

I've tried the following, but it doesn't work:

const url = "http://local.api.com";

async function fetchMovies() {
  await fetch(url + '/_/auth/sessions/start', {
    method: 'POST',
    body: JSON.stringify({email: 'admin@example.com', password: 'password'}),
    credentials: 'include',
    headers: {
      'Content-Type': 'application/json'
    }
  });

  const res = await fetch(url + '/_/items/movies', { credentials: 'include' });
  console.log(res.status);
  // => 403
}

fetchMovies();

The first request does receive a access_token cookie (maybe we should call that session), but it doesn't persist over to the second request.

[binal-7span]

@rijkvanzanten - Can you please try this code in #1280? It's working over there.

I would say we can close this PR as #1280 contain kill session too :)

[rijkvanzanten]

Closed in favor of #1280