Fix `ReferenceError: localStorage is not defined` on reload

[cjolowicz]

It appears that server-side rendering accesses localStorage, which is not defined in the node environment. To reproduce, log in, wait for redirect to /artists, then reload the browser tab.

[cjolowicz]

2019-02-01T22:43:23.685151+00:00 app[web.1]: ReferenceError: localStorage is not defined
2019-02-01T22:43:23.685171+00:00 app[web.1]: at WithAuth (/app/lib/components/Auth.js:23:19)
2019-02-01T22:43:23.685173+00:00 app[web.1]: at c (/app/node_modules/react-dom/cjs/react-dom-server.node.production.min.js:28:496)
2019-02-01T22:43:23.685175+00:00 app[web.1]: at Ga (/app/node_modules/react-dom/cjs/react-dom-server.node.production.min.js:31:1)
2019-02-01T22:43:23.685176+00:00 app[web.1]: at a.render (/app/node_modules/react-dom/cjs/react-dom-server.node.production.min.js:36:367)
2019-02-01T22:43:23.685178+00:00 app[web.1]: at a.read (/app/node_modules/react-dom/cjs/react-dom-server.node.production.min.js:35:450)
2019-02-01T22:43:23.685179+00:00 app[web.1]: at renderToString (/app/node_modules/react-dom/cjs/react-dom-server.node.production.min.js:47:82)
2019-02-01T22:43:23.685180+00:00 app[web.1]: at generateHTML (/app/lib/server/app.js:30:67)
2019-02-01T22:43:23.685182+00:00 app[web.1]: at app.get (/app/lib/server/app.js:44:16)
2019-02-01T22:43:23.685183+00:00 app[web.1]: at Layer.handle [as handle_request] (/app/node_modules/express/lib/router/layer.js:95:5)
2019-02-01T22:43:23.685184+00:00 app[web.1]: at next (/app/node_modules/express/lib/router/route.js:137:13)

[cjolowicz]

The overarching question is how to perform authentication in a server-side rendered SPA.

• https://blog.bugsnag.com/server-side-rendering-and-authenticated-content/
• https://security.stackexchange.com/questions/177203/is-csrf-possible-in-an-ssr-spa-with-cookie-authentication
• https://spectrum.chat/react/general/jwt-tokens-vs-cookies-for-authentication-in-a-server-side-rendered-react-app~a051f64d-8103-48e4-92f8-99fc701a7ae9?m=MTUxMTA0MTgzMDg2Mg==
• https://spectrum.chat/react/general/most-secure-way-to-persist-authentication-with-ssr~b26fbe1f-b816-44f4-84ce-b21faf219802

My takeaway from the discussions linked above is:

1. Authentication happens client-side against the API (not server-side as proposed in the bugsnag post).
2. The auth token is provided to the web server as a (non-httpOnly) cookie.
3. CSRF is not an issue as long as requests to the web server have no side-effects.
4. Use common techniques to mitigate XSS. Reading the auth cookie is the least of our problems. A successful XSS attack can already perform arbitrary requests using the cookie.