fix(FSADT1-1241): adding csrf support

.github/workflows/merge.yml

@@ -77,13 +77,8 @@ jobs:
             -p CHES_CLIENT_SECRET=${{ secrets.CHES_CLIENT_SECRET }}
             -p ADDRESS_COMPLETE_KEY=${{ secrets.ADDRESS_COMPLETE_KEY }}
             -p DB_PASSWORD=${{ secrets.DB_PASSWORD }}
-            -p COGNITO_REGION=${{ secrets.COGNITO_REGION }}
-            -p COGNITO_CLIENT_ID=${{ secrets.COGNITO_CLIENT_ID }}
             -p COGNITO_USER_POOL=${{ secrets.COGNITO_USER_POOL }}
-            -p COGNITO_DOMAIN=${{ secrets.COGNITO_DOMAIN }}
             -p COGNITO_ENVIRONMENT=TEST
-            -p COGNITO_REDIRECT_URI=https://${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}/dashboard
-            -p COGNITO_LOGOUT_URI='https://logontest7.gov.bc.ca/clp-cgi/logoff.cgi?retnow=1&returl=https://test.loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect/logout?redirect_uri=${{ secrets.COGNITO_LOGOUT_URI }}'
             -p CHES_MAIL_COPY=${{ secrets.CHES_MAIL_COPY }}
 
       - name: Conventional Changelog Update
@@ -168,8 +163,8 @@ jobs:
             -p CHES_API_URL='https://ches.api.gov.bc.ca/api/v1/email'
             -p BCREGISTRY_URI='https://bcregistry-prod.apigee.net'
             -p COGNITO_REGION=ca-central-1
-            -p COGNITO_COOKIE_DOMAIN=gov.bc.ca
             -p URL_ZONE=${{ env.ZONE }}
+            -p FRONTEND_URL='${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}' # change for vanity url later
 
       - name: Dev data replacement
         uses: bcgov-nr/[email protected]
@@ -214,8 +209,8 @@ jobs:
             -p COGNITO_USER_POOL=${{ secrets.COGNITO_USER_POOL }}
             -p COGNITO_DOMAIN=${{ secrets.COGNITO_DOMAIN }}
             -p COGNITO_ENVIRONMENT=TEST
-            -p COGNITO_REDIRECT_URI=https://${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}/dashboard
-            -p COGNITO_LOGOUT_URI='https://logontest7.gov.bc.ca/clp-cgi/logoff.cgi?retnow=1&returl=https://test.loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect/logout?redirect_uri=${{ secrets.COGNITO_LOGOUT_URI }}'
+            -p LANDING_URL='${{ secrets.COGNITO_LOGOUT_URI }}'
+            -p FRONTEND_URL='${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}' # change for vanity url later
 
       - name: Deploy Processor
         uses: bcgov-nr/[email protected]
@@ -282,13 +277,8 @@ jobs:
             -p CHES_CLIENT_SECRET=${{ secrets.CHES_CLIENT_SECRET }}
             -p ADDRESS_COMPLETE_KEY=${{ secrets.ADDRESS_COMPLETE_KEY }}
             -p DB_PASSWORD=${{ secrets.DB_PASSWORD }}
-            -p COGNITO_REGION=${{ secrets.COGNITO_REGION }}
-            -p COGNITO_CLIENT_ID=${{ secrets.COGNITO_CLIENT_ID }}
             -p COGNITO_USER_POOL=${{ secrets.COGNITO_USER_POOL }}
-            -p COGNITO_DOMAIN=${{ secrets.COGNITO_DOMAIN }}
             -p COGNITO_ENVIRONMENT=PROD
-            -p COGNITO_REDIRECT_URI=https://forestclient.nrs.gov.bc.ca/dashboard
-            -p COGNITO_LOGOUT_URI='https://logon7.gov.bc.ca/clp-cgi/logoff.cgi?retnow=1&returl=https://loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect/logout?redirect_uri=${{ secrets.COGNITO_LOGOUT_URI }}'
             -p CHES_MAIL_COPY=${{ secrets.CHES_MAIL_COPY }}
 
   prod-deploy:
@@ -351,8 +341,8 @@ jobs:
             -p CHES_API_URL='https://ches.api.gov.bc.ca/api/v1/email'
             -p BCREGISTRY_URI='https://bcregistry-prod.apigee.net'
             -p COGNITO_REGION=ca-central-1
-            -p COGNITO_COOKIE_DOMAIN=gov.bc.ca
             -p URL_ZONE=${{ env.ZONE }}
+            -p FRONTEND_URL='${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}' # change for vanity url later
 
       - name: Deploy Legacy
         uses: bcgov-nr/[email protected]
@@ -387,8 +377,8 @@ jobs:
             -p COGNITO_USER_POOL=${{ secrets.COGNITO_USER_POOL }}
             -p COGNITO_DOMAIN=${{ secrets.COGNITO_DOMAIN }}
             -p COGNITO_ENVIRONMENT=PROD
-            -p COGNITO_REDIRECT_URI=https://forestclient.nrs.gov.bc.ca/dashboard
-            -p COGNITO_LOGOUT_URI='https://logon7.gov.bc.ca/clp-cgi/logoff.cgi?retnow=1&returl=https://loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect/logout?redirect_uri=${{ secrets.COGNITO_LOGOUT_URI }}'
+            -p LANDING_URL='${{ secrets.COGNITO_LOGOUT_URI }}'
+            -p FRONTEND_URL='${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}' # change for vanity url later
 
       - name: Deploy Processor
         uses: bcgov-nr/[email protected]

.github/workflows/pr-open.yml

@@ -100,13 +100,8 @@ jobs:
             -p CHES_CLIENT_SECRET=${{ secrets.CHES_CLIENT_SECRET }}
             -p ADDRESS_COMPLETE_KEY=${{ secrets.ADDRESS_COMPLETE_KEY }}
             -p DB_PASSWORD=$(echo ${{github.ref}}${{github.event.number}}|md5sum|cut -d' ' -f1)
-            -p COGNITO_REGION=${{ secrets.COGNITO_REGION }}
-            -p COGNITO_CLIENT_ID=${{ secrets.COGNITO_CLIENT_ID }}
             -p COGNITO_USER_POOL=${{ secrets.COGNITO_USER_POOL }}
-            -p COGNITO_DOMAIN=${{ secrets.COGNITO_DOMAIN }}
-            -p COGNITO_ENVIRONMENT=DEV
-            -p COGNITO_REDIRECT_URI=https://${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}/dashboard
-            -p COGNITO_LOGOUT_URI='https://logontest7.gov.bc.ca/clp-cgi/logoff.cgi?retnow=1&returl=https://dev.loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect/logout?redirect_uri=https://${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}'
+            -p COGNITO_ENVIRONMENT=DEV            
             -p CHES_MAIL_COPY=${{ secrets.CHES_MAIL_COPY }}
 
       - name: Deploy Database Backup
@@ -159,8 +154,8 @@ jobs:
             -p CHES_API_URL='https://ches.api.gov.bc.ca/api/v1/email'
             -p BCREGISTRY_URI='https://bcregistry-prod.apigee.net'
             -p COGNITO_REGION=ca-central-1
-            -p COGNITO_COOKIE_DOMAIN=gov.bc.ca
             -p URL_ZONE=${{ needs.vars.outputs.url_zone }}
+            -p FRONTEND_URL='${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}'
 
       - name: Dev data replacement
         uses: bcgov-nr/[email protected]
@@ -205,8 +200,8 @@ jobs:
             -p COGNITO_USER_POOL=${{ secrets.COGNITO_USER_POOL }}
             -p COGNITO_DOMAIN=${{ secrets.COGNITO_DOMAIN }}
             -p COGNITO_ENVIRONMENT=DEV
-            -p COGNITO_REDIRECT_URI=https://${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}/dashboard
-            -p COGNITO_LOGOUT_URI='https://logontest7.gov.bc.ca/clp-cgi/logoff.cgi?retnow=1&returl=https://dev.loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect/logout?redirect_uri=https://${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}'
+            -p LANDING_URL='https://${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}'
+            -p FRONTEND_URL='https://${{ env.PREFIX }}-frontend.${{ env.DOMAIN }}'
 
       - name: Deploy Processor
         uses: bcgov-nr/[email protected]

backend/openshift.deploy.yml

@@ -44,13 +44,12 @@ parameters:
   - name: COGNITO_REGION
     description: Cognito region to be used
     required: true
-  - name: COGNITO_COOKIE_DOMAIN
-    description: Cognito cookie domain to be used
-    required: true
-    default: gov.bc.ca
   - name: URL_ZONE
     description: Zone to use for URL
     required: true
+  - name: FRONTEND_URL
+    description: Frontend URL
+    required: true
 objects:
   - kind: ImageStream
     apiVersion: v1
@@ -106,7 +105,7 @@ objects:
               name: ${NAME}
               env:
                 - name: FRONTEND_URL
-                  value: https://${NAME}-${URL_ZONE}-frontend.${DOMAIN}
+                  value: https://${FRONTEND_URL}
                 - name: LEGACY_URL
                   value: http://${NAME}-${ZONE}-legacy/api
                 - name: SELF_URI
@@ -175,10 +174,7 @@ objects:
                       name: ${NAME}-${ZONE}
                       key: cognito-environment
                 - name: COGNITO_REGION
-                  valueFrom:
-                    secretKeyRef:
-                      name: ${NAME}-${ZONE}
-                      key: cognito-region
+                  value: ${COGNITO_REGION}
                 - name: PROCESSOR_SERVICE_ACCOUNT_NAME
                   valueFrom:
                       secretKeyRef:

backend/src/main/java/ca/bc/gov/app/configuration/SecurityConfiguration.java

@@ -1,17 +1,17 @@
 package ca.bc.gov.app.configuration;
 
 import ca.bc.gov.app.ApplicationConstant;
-import ca.bc.gov.app.security.ForestHeadersCustomizer;
-import ca.bc.gov.app.security.CorsCustomizer;
 import ca.bc.gov.app.security.ApiAuthorizationCustomizer;
+import ca.bc.gov.app.security.CorsCustomizer;
+import ca.bc.gov.app.security.CsrfCustomizer;
+import ca.bc.gov.app.security.HeadersCustomizer;
 import ca.bc.gov.app.security.Oauth2Customizer;
 import java.util.List;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity.CsrfSpec;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
 import org.springframework.security.core.userdetails.User;
@@ -29,36 +29,37 @@
 @EnableWebFluxSecurity
 public class SecurityConfiguration {
 
-  /**
-   * This method configures the SecurityWebFilterChain, which is the main security filter for the
-   * application. It customizes the ServerHttpSecurity object by setting the authorization rules,
-   * OAuth2 resource server settings, CORS settings, CSRF settings, and HTTP Basic settings. It then
-   * builds the ServerHttpSecurity object into a SecurityWebFilterChain and returns it.
-   *
-   * @param http                 The ServerHttpSecurity object to be customized.
-   * @param corsSpecCustomizer   The customizer for the CORS settings.
-   * @param apiAuthorizationCustomizer   The customizer for the authorization rules.
-   * @param oauth2SpecCustomizer The customizer for the OAuth2 resource server settings.
-   * @param headersCustomizer    The customizer for the headers settings.
-   * @return The configured SecurityWebFilterChain.
-   */
-  @Bean
-  SecurityWebFilterChain springSecurityFilterChain(
-      ServerHttpSecurity http,
-      ForestHeadersCustomizer headersCustomizer,
-      CorsCustomizer corsSpecCustomizer,
-      ApiAuthorizationCustomizer apiAuthorizationCustomizer,
-      Oauth2Customizer oauth2SpecCustomizer
-  ) {
-    http
-        .headers(headersCustomizer)
-        .authorizeExchange(apiAuthorizationCustomizer)
-        .oauth2ResourceServer(oauth2SpecCustomizer)
-        .cors(corsSpecCustomizer)
-        .csrf(CsrfSpec::disable)
-        .httpBasic(Customizer.withDefaults());
-    return http.build();
-  }
+/**
+ * This method is a Spring Bean that configures the Spring Security filter chain.
+ * The filter chain is a mechanism that Spring Security uses to apply security features to HTTP requests.
+ *
+ * @param http The ServerHttpSecurity instance that is used to build the security filter chain.
+ * @param headersCustomizer A customizer for the HTTP headers security settings.
+ * @param corsSpecCustomizer A customizer for the Cross-Origin Resource Sharing (CORS) security settings.
+ * @param apiAuthorizationCustomizer A customizer for the API authorization security settings.
+ * @param oauth2SpecCustomizer A customizer for the OAuth2 resource server security settings.
+ * @param csrfSpecCustomizer A customizer for the Cross-Site Request Forgery (CSRF) security settings.
+ *
+ * @return The configured SecurityWebFilterChain.
+ */
+@Bean
+SecurityWebFilterChain springSecurityFilterChain(
+    ServerHttpSecurity http,
+    HeadersCustomizer headersCustomizer,
+    CorsCustomizer corsSpecCustomizer,
+    ApiAuthorizationCustomizer apiAuthorizationCustomizer,
+    Oauth2Customizer oauth2SpecCustomizer,
+    CsrfCustomizer csrfSpecCustomizer
+) {
+  http
+      .headers(headersCustomizer)
+      .authorizeExchange(apiAuthorizationCustomizer)
+      .oauth2ResourceServer(oauth2SpecCustomizer)
+      .cors(corsSpecCustomizer)
+      .csrf(csrfSpecCustomizer)
+      .httpBasic(Customizer.withDefaults());
+  return http.build();
+}
 
   /**
    * This method creates a ReactiveJwtDecoder bean. The ReactiveJwtDecoder is used to decode JWTs in