CSRF protection about grpcui HOT 2 CLOSED

After some f2f discussion, here is the revised approach:

1. The grpcui package (which contains numerous handler functions, which an application can compose into a custom web form that can be embedded anywhere) will not have anything related to CSRF. CSRF is a higher level concern that can be added by decorating these handlers.
2. The standalone package will provide CSRF protection (thereby also making the grpcui command-line tool safe from CSRF attacks). It will do so using the strategy as described above, more-or-less:
   • The standalone.Handler will wrap the grpcui.RPCInvokeHandler (i.e. the decorator pattern). The wrapper will query for a X-CSRF-Token header value and cookie and make sure they match. If either is absent or they do not match, the request fails with a "401 Unauthorized".
   • The HTML page used by standalone.Handler will get a new inline script which uses the jQuery ajaxSend function to install an interceptor that will query the CSRF token from cookie and use it to set a X-CSRF-Token header.
   • The root handler in standalone.Handler, which returns the HTML page, will get some new logic: it will look for a cookie. If the cookie is not present, it will create it, setting the value to a token generated by a secure RNG.

Applications that customize the web form (using the building blocks in the grpcui package) will have to provide their own CSRF protection. Applications that choose to use the all-in-one handler in the standalone package will get it for free.

The standalone.Handler could be further strengthened by a CSP policy that only allows local scripts (same domain). However, the gRPC web form currently includes an inline script. So the handler would need to be able to compute a hash for the script in order to whitelist it in the CSP policy. This might be tackled later.

from grpcui.

@donjaime, @ZackFS, @anwar-fs: mind taking a look at the proposed approach above to make sure it smells right. (If you need more context, feel free to ping me in Slack.)

from grpcui.