New `/api/security/csrf` endpoint & updated CSRF docs

tdonohue commented 4 months ago

Documentation for the new GET /api/security/csrf endpoint added by https://github.com/DSpace/DSpace/pull/9321

In that PR, this endpoint is currently only necessary for ITs related to CSRF tokens because Spring Security 6 doesn't support cookie-based CSRF creation in its integration test tools.
It also is used to fix https://github.com/DSpace/DSpace/issues/9236 (see https://github.com/DSpace/dspace-angular/pull/2886 and https://github.com/DSpace/dspace-angular/pull/2897)

Adding more details to the documentation on CSRF Token behavior, by including details on how the User Interface interacts with the REST API with regards to CSRF tokens.

tdonohue commented 3 months ago

Assigning to @abollini for feedback on this Contract & also whether we should backport this to 7.x as this endpoint (along with minor changes to the Angular UI) fixes this bug https://github.com/DSpace/DSpace/issues/9236 (and that bug also impacts 7.x)

tdonohue commented 2 months ago

Merging to main. I've also added the port to dspace-7_x flag as this fix should be ported to 7.x (along with the implementation code -- I'll create PRs for those as well.)

dspace-bot commented 2 months ago

Successfully created backport PR for dspace-7_x:

269

DSpace / RestContract

New `/api/security/csrf` endpoint & updated CSRF docs #259

269