nico-api Admin UI needs CSRF protection

[kensimon]

Version

main

Describe the bug.

It looks like we're not doing any CSRF validation in the admin UI, token-based or otherwise.

It looks like recent tower-http versions have a csrf feature we can enable: https://docs.rs/tower-http/latest/tower_http/csrf/index.html ... we'd just want to make sure to carve out the right settings for the oauth2 callback routes since they have certain expected cross-site characteristics.

Otherwise we could look at adding a simple middleware layer that checks for Sec-Fetch-Site on the admin-ui and rejects it if it's not none or same-origin.

Code of Conduct

• I agree to follow NVIDIA Infra Controller's Code of Conduct
• I have searched the open bugs and have found no duplicates for this bug report

[ajf]

@kensimon is this to go on backlog for you or just unassigned for later? I would have just backlogged it for later, but the PR you put in #3492 mentions this so it's unclear if you intend to fix this as part of that PR?

[kensimon]

@ajf no that PR is separate, but CodeRabbit ever-so-helpfully pointed out the lack of CSRF as part of it (even though it was pre-existing.) But I think this is easy enough to do that I'll put it in 2.1.

Looks like newer versions of tower-http have a csrf layer we can use: https://docs.rs/tower-http/latest/tower_http/csrf/struct.CsrfLayer.html ... so this should be an easy task, I'll have a look tomorrow. If upgrading tower is too hard in the short-term, it's also an easy fix of just adding a few headers, so not a huge deal either way.