CORS should only be bypassed on PublicPage if not logged in

[susnux]

Summary

To prevent CSRF attack vectors CORS should only be bypassed if not logged in on @PublicPage.
If you add the CORS annotation you would expect all users to be validated even on @PublicPage, e.g. for APIs where anonymous users can submit data but also logged in users, currently there is no protection against CSRF on those API endpoints.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[susnux]

Any update on this one? Something I can help with?

[nickvergessen]

LGTM, but not too deep in the topic

[juliusknorr]

Restarted drone since the history was gone

[nickvergessen]

1. Test\AppFramework\Middleware\Security\CORSMiddlewareTest::testCORSShouldNeverAllowCookieAuth
   OC\AppFramework\Middleware\Security\Exceptions\SecurityException: CORS requires basic auth

seems related :/

[susnux]

seems related :/

The exception is expected, fixed the new test.