[yew-devel] [PATCH yew-comp 1/2] http wasm client: load csrf token from global Proxmox object

[Shannon Sterz]

previously csrf tokens were only loaded from session storage. this
could lead to two scenarios:

- the csrf token expired while the newer authentication ticket was
still valid.
- when restoring a session, session cookies were restored, but session
storage seemingly isn't always restored (tested in chromium and ff).
this lead to no csrf token being loaded here, the
`unwrap_or_default()` would then return the empty string as a csrf
token.

both scenarios would lead to a situation where a valid authentication
cookie was present, but the csrf token was empty or expired. the
result is that all GET requests would work properly, as we don't check
csrf tokens there. however, the first non-GET request would lead to a
logout.

to fix this, we first load the token from the Proxmox object that is
injected via a script in the index.html for all proxmox products. we
prefer this token over the one in session storage.
authentication_from_cookie (that calls the extract_auth_from_cookie
function), is and should only be called when the page was just loaded.
so the csrf token in the Proxmox object will always be fresher than
the one in the session storage.

additionally, split out the csrf token portion of
extract_auth_from_cookie into its own function to more cleanily
separate these concern. authentication_from_cookie,
extract_auth_from_cookie's only user, has been adapted to trigger a
new log in if no csrf token can be found as well.

Signed-off-by: Shannon Sterz <s.sterz at proxmox.com>
---
 src/http_client_wasm.rs | 43 ++++++++++++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 13 deletions(-)

diff --git a/src/http_client_wasm.rs b/src/http_client_wasm.rs
index 25d0dd2..51933bb 100644
--- a/src/http_client_wasm.rs
+++ b/src/http_client_wasm.rs
@@ -3,6 +3,7 @@ use std::pin::Pin;
 use std::rc::Rc;
 use std::sync::Mutex;
 
+use js_sys::Reflect;
 use percent_encoding::percent_decode_str;
 use serde::Serialize;
 use serde_json::Value;
@@ -20,23 +21,25 @@ fn convert_js_error(js_err: ::wasm_bindgen::JsValue) -> Error {
 }
 
 pub fn authentication_from_cookie(project: &dyn ProjectInfo) -> Option<Authentication> {
-    if let Some((ticket, csrfprevention_token)) = extract_auth_from_cookie(project) {
-        let ticket: Result<Ticket, _> = ticket.parse();
-        if let Ok(ticket) = ticket {
-            return Some(Authentication {
-                api_url: String::new(),
-                userid: ticket.userid().to_string(),
-                ticket,
-                clustername: None,
-                csrfprevention_token,
-            });
+    if let Some(ticket) = extract_auth_from_cookie(project) {
+        if let Some(csrfprevention_token) = current_csrf_token() {
+            let ticket: Result<Ticket, _> = ticket.parse();
+            if let Ok(ticket) = ticket {
+                return Some(Authentication {
+                    api_url: String::new(),
+                    userid: ticket.userid().to_string(),
+                    ticket,
+                    clustername: None,
+                    csrfprevention_token,
+                });
+            }
         }
     }
 
     None
 }
 
-fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<(String, String)> {
+fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<String> {
     let cookie = crate::get_cookie();
     //log::info!("COOKIE: {}", cookie);
 
@@ -55,8 +58,7 @@ fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<(String, String
             if key == name {
                 let items: Vec<&str> = value.split(':').take(2).collect();
                 if prefixes.contains(&items[0]) {
-                    let csrf_token = crate::load_csrf_token().unwrap_or_default();
-                    return Some((value.to_string(), csrf_token));
+                    return Some(value.to_string());
                 }
             }
         }
@@ -65,6 +67,21 @@ fn extract_auth_from_cookie(project: &dyn ProjectInfo) -> Option<(String, String
     None
 }
 
+fn current_csrf_token() -> Option<String> {
+    let window = gloo_utils::window();
+
+    // prefer the fresh CSRFPreventionToken from the `Proxmox` global object set via a script in
+    // the document index on first load.
+    if let Ok(proxmox) = Reflect::get(&window, &"Proxmox".into()) {
+        if let Ok(token) = Reflect::get(&proxmox, &"CSRFPreventionToken".into()) {
+            return token.as_string();
+        }
+    }
+
+    // fall back to the csrf token stored in the session storage if no fresher token has been set
+    crate::load_csrf_token()
+}
+
 pub struct HttpClientWasm {
     project: &'static dyn ProjectInfo,
     auth: Mutex<Option<Authentication>>,
-- 
2.47.3