Logout endpoint should use POST not GET #1830

chrisgilmerproj · 2019-03-06T19:45:46Z

Description

We should not use GET for logout. This changes the endpoints, uses forms, and changes the redirect from a 307 to a 303.

Reviewer Notes

In this PR I modify the middleware to only create one public CSRF Token in the middleware. The reason for this is that we only need it to change on session updates (like user login/logout) and for debugging you can't track multiple public tokens (even though they ought to all unmask as the same value). It's a little less logic to have to parse when looking into CSRF issues.

Similarly, I no longer call csrf.Token(r) in all the places. Instead I rely on the middleware to properly set the cookie and then we only grab it from the cookie. This changes how the devlocal login page works but has no real effect, except again, to eliminate confusion about what tokens are being generated for debugging.

Setup

Login and then logout!

Code Review Verification Steps

There are no aXe warnings for UI.
This works in IE
This works in MSEdge
Request review from a member of a different team.
Have the Pivotal acceptance criteria been met for this change?

References

Pivotal story for this change
StackOverflow Logout Get or Post explains more about the approach used.

A number of past PRs that I looked at while prepping this PR:

stangah · 2019-03-06T20:44:06Z

Code looks fine, and it tested well for me on IE11

I think the new logout button needs some formatting though:
New:

Old:

codecov · 2019-03-06T21:02:08Z

Codecov Report

Merging #1830 into master will increase coverage by 0.14%.
The diff coverage is 31.03%.

@@            Coverage Diff             @@
##           master    #1830      +/-   ##
==========================================
+ Coverage   49.38%   49.52%   +0.14%     
==========================================
  Files         427      428       +1     
  Lines       18341    18466     +125     
  Branches     1636     1636              
==========================================
+ Hits         9058     9146      +88     
- Misses       8493     8518      +25     
- Partials      790      802      +12

… button and then click through

…new CSS

…ar across the apps.

chrisgilmerproj · 2019-03-07T23:27:30Z

I can't seem to get this working in Internet Explorer. The best I can get is that CSRF middleware is blocking me, but I can't figure why. The cookie is certainly getting sent along with fetch() and its being rejected. I'll keep digging here.

chrisgilmerproj · 2019-03-07T23:28:09Z

src/shared/User/api.js

+  console.log('============');
+  console.log(token);
+  console.log(document.cookie);
+  console.log('============');


I need to remove this, but only after I figure out if the cookie is incorrect.

chrisgilmerproj · 2019-03-08T00:21:19Z

pkg/logging/log.go

@@ -85,6 +85,7 @@ func LogRequestMiddleware(gitBranch string, gitCommit string) func(inner http.Ha
 				zap.String("x-forwarded-for", r.Header.Get("x-forwarded-for")),
 				zap.String("x-forwarded-host", r.Header.Get("x-forwarded-host")),
 				zap.String("x-forwarded-proto", r.Header.Get("x-forwarded-proto")),
+				zap.String("x-csrf-token", r.Header.Get("x-csrf-token")),


Make sure to remove this before merging. It's for testing that the token is being sent properly from IE (which it is!).

… via an async operation while sending another request

rdhariwal · 2019-03-08T15:23:21Z

I can't seem to get this working in Internet Explorer. The best I can get is that CSRF middleware is blocking me, but I can't figure why. The cookie is certainly getting sent along with fetch() and its being rejected. I'll keep digging here.

I can debug go in goland if you want to look at the guts of the request. Happy to pair on it or stand in as 🦆 to bounce ideas

chrisgilmerproj · 2019-03-08T19:37:54Z

pkg/handlers/responders.go

 	}
 }

 // WriteResponse updates the session cookie before writing out the details of the response
 func (cur *CookieUpdateResponder) WriteResponse(rw http.ResponseWriter, p runtime.Producer) {
 	auth.WriteSessionCookie(rw, cur.session, cur.cookieSecret, cur.noSessionTimeout, cur.logger)
+	auth.WriteMaskedCSRFCookie(rw, csrf.Token(cur.request), cur.noSessionTimeout, cur.logger)


I think what this does is ensure even API requests get the cookie set. I'm not clear on if it's helping.

chrisgilmerproj · 2019-03-08T20:06:46Z

src/shared/User/api.js

+    })
+    .catch(err => {
+      console.log(err);
+    });


What should I do with error responses?

Maybe send a signal that the browser is idle.

…y the middleware as a cookie

src/shared/User/api.js

chrisgilmerproj · 2019-03-11T20:04:09Z

Latest change works in MSEdge! Thanks @donaldthai .

Now to get the integration tests working.

chrisgilmerproj · 2019-03-11T21:15:13Z

pkg/auth/authentication/devlocal.go

 					{{.Email}}
 					({{if .DpsUserID}}dps{{else if .TspUserID}}tsp{{else if .OfficeUserID}}office{{else}}milmove{{end}})
-					<button name="id" value="{{.ID}}" data-hook="existing-user-login">Login</button>
+					<input type="hidden" name="id" value="{{.ID}}" />
+					<button type="submit" value="{{.ID}}" data-hook="existing-user-login">Login</button>


This fixes how IE11 does login, which previously wasn't working. Thanks to @donaldthai for the fix!

rdhariwal

donaldthai

LGTM

Logout endpoint should use POST not GET

4c42833

chrisgilmerproj self-assigned this Mar 6, 2019

Chris Gilmer added 2 commits March 6, 2019 20:15

Fix up server test to check for the redirect location in the header

e958182

Rename css file

0b893de

Chris Gilmer added 10 commits March 6, 2019 22:07

Clear cookies instead of visiting logout page. Logout should test the…

49346b6

… button and then click through

Try to fix build problem

1049180

Use an onClick action instead of using a form for logout. Remove the …

c1dca5c

…new CSS

Clean up logout method for cypress

d954d0e

Only clear cookies to affect a logout

d9d94c1

Use the same redirect url for devlocal as for non login gov accounts

1605f3f

Fix logout for cypress tests. Ensure all the homepage tests are simil…

277e6f2

…ar across the apps.

Use logout instead of clear cookies

4554d74

Visit home page again after logout in case of redirect

fabf78e

Debug

31b1a66

chrisgilmerproj requested review from Ronolibert, pjdufour-truss, rdhariwal and stangah March 7, 2019 23:26

chrisgilmerproj commented Mar 7, 2019

View reviewed changes

Use swagger http instead of fetch

32de70c

chrisgilmerproj commented Mar 8, 2019

View reviewed changes

Chris Gilmer added 2 commits March 8, 2019 00:37

Set CSRF token only once, on login. Prevents CSRF token from changing…

4b41397

… via an async operation while sending another request

Log if we are in dev or test mode

7269aeb

chrisgilmerproj requested a review from donaldthai March 8, 2019 00:55

Chris Gilmer added 2 commits March 8, 2019 17:35

Reuse the request interceptor

a65b231

Revert taking out the csrf middleware. Add csrf token to api responder

f33fe55

chrisgilmerproj requested a review from tinyels March 8, 2019 19:20

chrisgilmerproj commented Mar 8, 2019

View reviewed changes

Chris Gilmer added 3 commits March 8, 2019 19:59

Fix devlocal login button for IE11

ed3283d

Remove log line

c2faec7

Remove changes to api responder

a9ec6a1

chrisgilmerproj commented Mar 8, 2019

View reviewed changes

Chris Gilmer added 6 commits March 8, 2019 21:39

Only add csrf cookie if one hasn't been set

7e0c5e3

Instead of generating a new token for devlocal just use the one set b…

e63d3cb

…y the middleware as a cookie

Fix message

04b3d80

Add a clarifying message

123a5d3

Fix cookie middleware test

d7b1752

Remove unused var

03963ac

donaldthai suggested changes Mar 9, 2019

View reviewed changes

src/shared/User/api.js Show resolved Hide resolved

Chris Gilmer added 2 commits March 11, 2019 16:04

Always use 'same-origin' for sending cookies through on fetch

ed2c7f3

Fix pull request template for supported browsers

e284455

Chris Gilmer added 2 commits March 11, 2019 20:04

Merge branch 'master' into cg_164014224_logout_should_use_post

8f10cb7

Ensure that both the button and the input have the value of the user id

6c523c5

chrisgilmerproj commented Mar 11, 2019

View reviewed changes

Chris Gilmer added 3 commits March 11, 2019 21:20

Ensure csrf cookie is set only once

793912e

Add note about same-origin policy

04e8651

Remove console log

3434734

rdhariwal approved these changes Mar 12, 2019

View reviewed changes

donaldthai approved these changes Mar 12, 2019

View reviewed changes

chrisgilmerproj merged commit 4e61612 into master Mar 12, 2019

chrisgilmerproj deleted the cg_164014224_logout_should_use_post branch March 12, 2019 20:21

stangah mentioned this pull request Mar 12, 2019

Revert "Logout endpoint should use POST not GET" #1858

Merged

chrisgilmerproj mentioned this pull request Mar 13, 2019

Revert "Revert "Logout endpoint should use POST not GET"" #1861

Merged

3 tasks

chrisgilmerproj mentioned this pull request Mar 22, 2019

Load testing with locust.io #1597

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Logout endpoint should use POST not GET #1830

Logout endpoint should use POST not GET #1830

chrisgilmerproj commented Mar 6, 2019 •

edited

stangah commented Mar 6, 2019

codecov bot commented Mar 6, 2019 •

edited

chrisgilmerproj commented Mar 7, 2019

chrisgilmerproj Mar 7, 2019

chrisgilmerproj Mar 8, 2019

rdhariwal commented Mar 8, 2019

chrisgilmerproj Mar 8, 2019

chrisgilmerproj Mar 8, 2019

chrisgilmerproj Mar 8, 2019

chrisgilmerproj commented Mar 11, 2019

chrisgilmerproj Mar 11, 2019

rdhariwal left a comment

donaldthai left a comment

Logout endpoint should use POST not GET #1830

Logout endpoint should use POST not GET #1830

Conversation

chrisgilmerproj commented Mar 6, 2019 • edited

Description

Reviewer Notes

Setup

Code Review Verification Steps

References

stangah commented Mar 6, 2019

codecov bot commented Mar 6, 2019 • edited

Codecov Report

chrisgilmerproj commented Mar 7, 2019

chrisgilmerproj Mar 7, 2019

Choose a reason for hiding this comment

chrisgilmerproj Mar 8, 2019

Choose a reason for hiding this comment

rdhariwal commented Mar 8, 2019

chrisgilmerproj Mar 8, 2019

Choose a reason for hiding this comment

chrisgilmerproj Mar 8, 2019

Choose a reason for hiding this comment

chrisgilmerproj Mar 8, 2019

Choose a reason for hiding this comment

chrisgilmerproj commented Mar 11, 2019

chrisgilmerproj Mar 11, 2019

Choose a reason for hiding this comment

rdhariwal left a comment

Choose a reason for hiding this comment

donaldthai left a comment

Choose a reason for hiding this comment

chrisgilmerproj commented Mar 6, 2019 •

edited

codecov bot commented Mar 6, 2019 •

edited