Bug 1622372 - Require CSRF token on all proxied requests

[spadgett]

• Require a CSRF token on all proxied requests. This prevents loading
  content hosted from a pod under the console domain by clicking on a
  link that uses the console proxy. Previously, it was not required for
  GET requests.
• Do not forward the X-CSRFToken header through the proxy.
• Set Content-Security-Policy: default-src 'none' in the proxied
  response to prevent scripts from running in proxied content.

In order to support the CSRF token for WebSockets, this adds an
x-csrf-token query parameter when headers can't be set. It also updates
the console to check the Origin header when present since Referer is
not set for WebSockets.

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1622372

/assign @liggitt

[liggitt]

lgtm

[SSshahan]

@spadgett one quick question: how does we including csrf-token into proxied requests to perform GET requests? It can get application content with web console proxy from terminal like: curl -k -X GET https://<master>/api/v1/namespaces/hasha-pro1/services/ruby-ex:8080-tcp/proxy/ --header "Authorization: Bearer l22bZp9lMQ5Vr6PpfuHIjqu-tvzWLr4dyMjcPNahWVI".
I tried with CSRF token on the admin console but get nothing output: http://pastebin.test.redhat.com/641927. The CSRF token copied from Storage/Cookie value on the admin console develop windows. I am not clear about it yet, could you point me how to make it works? Thanks!

[SSshahan]

@spadgett bump, in case you miss the above question. Thank you.

[spadgett]

@SSshahan You need to include both the X-CSRFToken and Authorization headers in the request. I don't see Authorization in the pastebin. You should try curl with -v for verbose output.

edit: This should actually be a cookie not the authorization header... (Getting my consoles mixed up.)

[SSshahan]

@spadgett thanks, but get 401 Unauthorized error with user and X-CSRFToken setting. The X-CSRFToken comes from the csrf-token value in the Storage/Cookie by enter F12. http://pastebin.test.redhat.com/644276. Any other places with the wrong thing?

[spadgett]

Right, it's expected since the request doesn't have the two cookies. You should include the csrf-token and openshift-session-token cookies in the request.

I'd recommend using "Copy -> Copy as cURL" from the Network tab of Chrome developer tools.

[SSshahan]

@spadgett It works finally, copy as cURL is a good approach. Thank you.