Record an ActivityLog when session anomalies are detected for a user

[diox]

Description

When session authentication is used (login_required or SessionIDAuthentication are about to return a valid user) this checks that several key HTTP headers in the request match what we had in the session. Any mismatch we didn't already know about counts as an anomaly and is logged.

The feature is behind a enable-session-anomaly-recording waffle switch.

Testing

These headers are added/overwritten by the CDN/WAF, but you can test locally by:

• Enabling the enable-session-anomaly-recording waffle switch
• Grabbing the session ID from the cookies of an authenticated user from your browser
• Making an authenticated API request With that session ID to an API that allows session authentication, with one or more of the headers (Client-JA4, Cloudfront-Viewer-Country, Ohfp) set
  • Nothing should happen yet. If you inspect the session in a shell however, you should see we started recording the values of the headers in the session:

  from importlib import import_module
  engine = import_module(settings.SESSION_ENGINE)
  print(engine.SessionStore(session_key=<session_id>).get('request_headers'))

• Repeating previous step while changing the value for one or more of the headers that was present before: you should still be authenticated but inspecting the database you should see an ActivityLog for that user showing the differences in details. You should also see the same thing in the session under a session_anomalies key.

Fixes https://mozilla-hub.atlassian.net/browse/AMOENG-2165
Fixes https://mozilla-hub.atlassian.net/browse/AMOENG-2170

[diox]

Hasn't been true for a while...

[diox]

redirect=False wasn't used.