Enable authorization header as CSRF protection

[feedmeapples]

What was changed

• Allows HTTP requests with set authorization header to pass CSRF check

Why?

In case when API is hosted under different origin from the UI the existing CSRF rules block API POST/PUT/.. insecure HTTPs methods which result in Terminate/.. buttons to not work. The change allows the requests with Authorization header set to pass the CSRF check as it still protects against CSRF

Checklist

1. Closes

2. How was this tested:

new unit tests

3. Any docs updates needed?

[mcbryde]

This looks like it'll skip csrf protection if the authorization header is set to any value. If that's the case, then it allows a full bypass of CSRF protection with an invalid authorization header.

[GiantRobots]

Since CSRF attacks use the implicit sending of cookies shouldn't this be okay because a user wouldn't be able to add this header to bypass the CSRF check AND successfully become authenticated?

[feedmeapples]

correct, if authorization header is set (though since this is an explicit auth flow attackers shouldn't be able to do that with the CSRF attack) then it's up to the authorization plugin on Temporal side to deny the request

[feedmeapples]

as discussed directly adding unit tests to make sure authorization header is always prioritized over an auth cookie here

ui-server/server/auth/auth.go

Line 148 in e9c7a9c

rToken := c.Request().Header.Get(echo.HeaderAuthorization)