Merge pull request #86 from docusign/csrf-server-side-sessions

Add CSRF protection and server-side sessions to login

Author: paigesrossi

.gitignore

@@ -5,7 +5,7 @@
 private.key
 
 # dependencies
-/node_modules
+*/node_modules
 client/node_modules
 /.pnp
 .pnp.js

client/package-lock.json

@@ -68,9 +68,22 @@ class Login extends Component {
     */
     login = async (role) => {
         try {
+            const apiUrl = process.env.REACT_APP_API_URL || 'http://localhost:5000/api';
+            // Fetch a CSRF token bound to this session before triggering the
+            // JWT-grant flow.  The token must be echoed back in the request
+            // header so the server can verify the call originates from this SPA.
+            const csrfRes = await axios.get(`${apiUrl}/auth/csrf-token`, { withCredentials: true });
+            const csrfToken = csrfRes.data.csrfToken;
+
             //get the jwt stored in session cookie
-            const apiUrl = process.env.REACT_APP_API_URL;
-            let loginReq = await axios.get(`${apiUrl}/auth/login`);
+            let loginReq = await axios.post(
+                `${apiUrl}/auth/login`,
+                {},
+                {
+                    withCredentials: true,
+                    headers: { 'X-CSRF-Token': csrfToken },
+                }
+            );
             //if status is 210, redirect the user to the constent page
             if (loginReq.status === 210) {
                 window.location = loginReq.data;

client/src/containers/Login/Login.js

@@ -155,7 +155,7 @@ const addNewOfficeToSessionIfMissing = async (req) => {
                 //continue if it is a name already exists error
                 let sameNameErrorMessage = 
                     'The office \'' + newOffice.name + '\' already exists. Please choose a different name.';
-                if(error.response.body.message !== sameNameErrorMessage) {
+                if(error?.response?.body?.message !== sameNameErrorMessage && error?.body?.message !== sameNameErrorMessage) {
                     //send the error if you are out of tries
                     if(tries === 5) {
                         throw error;
@@ -173,6 +173,14 @@ const addNewOfficeToSessionIfMissing = async (req) => {
 
 
 
+/**
+ * Issues a fresh CSRF token for the session.
+ * The client must call this before POSTing to /login.
+ */
+module.exports.getCsrfToken = (req, res) => {
+    res.json({ csrfToken: req.csrfToken() });
+};
+
 /**
  *  Login user
  *  request body: