Allow logging in with lobste.rs

[msfjarvis]

After doing some digging into how lobste.rs makes requests from the web frontend, I believe it is wholly possible to execute authenticated operations from within Claw.

Authentication

1. When logging in, the lobsters_trap cookie is set that appears to be what is used to authenticate the user.
2. Requests also need to be accompanied by a CSRF token, which Rails uses internally to validate the request.

Obtaining credentials

The cookie should be trivial to extract through a WebView, and there is an Accompanist WebView component to make it easy to deal with in Compose.

Extracting the CSRF token is more challenging, since it is sent as part of the webpage by Rails. One way to do that could be to load a fixed number of bytes of the lobste.rs front page when the app is launched and extracting the meta tag that contains the CSRF token.

Dealing with cookie expiry

I have no idea what to do about this. The lobsters_trap cookie is set to expire after 1 month which is fairly decent, but I don't have a way to refresh it without making the user log in again which is probably fine?

[msfjarvis]

CSRF token extraction has been implemented c1f1d67

[caius]

Dealing with cookie expiry

I think the session cookie gets updated every successful request, so the month expiry only occurs if you've not made a request to lobsters with the existing cookie for a month. Keeps you logged in perpetually. You'll probably want to check the response headers for a new Set-Cookie value and store that when you make a request.

[msfjarvis]

Dealing with cookie expiry

I think the session cookie gets updated every successful request, so the month expiry only occurs if you've not made a request to lobsters with the existing cookie for a month. Keeps you logged in perpetually. You'll probably want to check the response headers for a new Set-Cookie value and store that when you make a request.

Oh, that shouldn't be too hard to implement. Thank you so much!

[caius]

Thinking about this some more, the session contains the CSRF token for rails to compare it against what's sent in the current request. I think your flow to submit a Post (well, non Get) request will need to be something like:

1. Make Get request to lobste.rs
2. Parse out CSRF token from meta tag
3. Save Set-Cookie header from same response
4. Make Post request with both Cookie header from step 3 and CSRF token value from step 2

This will ensure the CSRF token value in the session cookie matches the one in the form you're submitting. (The reason this is considered secure is you can't tamper with the session cookie value without knowing the secret key that's held server-side. All you can do is request it & submit later.)