feat: add spa support for CSRF by setting into cookie

[svenzik]

add spa support for CSRF by setting into cookie

Signed-off-by: Sven Mitt svenzik@users.noreply.github.com

[mrts]

We should assume that frontend and backend are served from different hosts or at least ports, so CORS must be configured as well along the lines of the following if useSpaCsrfConfiguration is enabled:

  @Bean
  @ConditionalOnProperty(
            name = USE_SPA_CSRF_CONFIGURATION_PROPERTY, // see below
            havingValue = "true"
  )
  CorsConfigurationSource corsConfigurationSource(YAMLConfig yamlConfig) {
      CorsConfiguration configuration = new CorsConfiguration();
      configuration.setAllowedOrigins(List.of(yamlConfig.getLocalOrigin()));
      configuration.setAllowedMethods(List.of("GET", "POST", "OPTIONS"));
      configuration.setAllowedHeaders(List.of("Content-Type", "X-XSRF-TOKEN"));
      configuration.setAllowCredentials(true);

      UrlBasedCorsConfigurationSource source =
              new UrlBasedCorsConfigurationSource();
      source.registerCorsConfiguration("/**", configuration);
      return source;
  }

CORS must be activated in the security filter chain as well in this case:

       if (useSpaCsrfConfiguration) {
           http.cors(Customizer.withDefaults());
       }

Also, extract the property to a constant to avoid duplication:

  private static final String USE_SPA_CSRF_CONFIGURATION_PROPERTY =
          "web-eid-auth-token.csrf.use-spa-configuration";