General: Add csrf protection + sameSite none cookie

src/main/java/de/tum/cit/aet/artemis/core/config/SecurityConfiguration.java

@@ -35,6 +35,7 @@
 
 import de.tum.cit.aet.artemis.core.security.DomainUserDetailsService;
 import de.tum.cit.aet.artemis.core.security.Role;
+import de.tum.cit.aet.artemis.core.security.filter.CsrfArtemisFilter;
 import de.tum.cit.aet.artemis.core.security.filter.SpaWebFilter;
 import de.tum.cit.aet.artemis.core.security.jwt.JWTConfigurer;
 import de.tum.cit.aet.artemis.core.security.jwt.TokenProvider;
@@ -54,6 +55,8 @@ public class SecurityConfiguration {
 
     private final CorsFilter corsFilter;
 
+    private final CsrfArtemisFilter csrfArtemisFilter = new CsrfArtemisFilter();
+
     private final ProfileService profileService;
 
     private final Optional<CustomLti13Configurer> customLti13Configurer;
@@ -171,7 +174,9 @@ public SecurityFilterChain filterChain(HttpSecurity http, SecurityProblemSupport
             // Disables CSRF (Cross-Site Request Forgery) protection; useful in stateless APIs where the token management is unnecessary.
             .csrf(AbstractHttpConfigurer::disable)
             // Adds a CORS (Cross-Origin Resource Sharing) filter before the username/password authentication to handle cross-origin requests.
+            // sets the filter chain: CorsFilter -> CsrfArtemisFilter -> UsernamePasswordAuthenticationFilter
             .addFilterBefore(corsFilter, UsernamePasswordAuthenticationFilter.class)
+            .addFilterBefore(csrfArtemisFilter, UsernamePasswordAuthenticationFilter.class)
             // Configures exception handling with a custom entry point and access denied handler for authentication issues.
             .exceptionHandling(handler -> handler.authenticationEntryPoint(securityProblemSupport).accessDeniedHandler(securityProblemSupport))
             // Adds a custom filter for Single Page Applications (SPA), i.e. the client, after the basic authentication filter.

src/main/java/de/tum/cit/aet/artemis/core/security/filter/CsrfArtemisFilter.java

@@ -0,0 +1,36 @@
+package de.tum.cit.aet.artemis.core.security.filter;
+
+import java.io.IOException;
+
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+public class CsrfArtemisFilter extends OncePerRequestFilter {
+
+    private static final Logger log = LoggerFactory.getLogger(CsrfArtemisFilter.class);
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+
+        // Check if the custom CSRF header is present in the request
+        if (request.getHeader("X-ARTEMIS-CSRF") != null) {
+            filterChain.doFilter(request, response);
+        }
+        else {
+            // Reject the request if the header is missing
+            response.sendError(HttpServletResponse.SC_FORBIDDEN, "Missing CSRF protection header");
+        }
+    }
+
+    // exclude all non api calls such as git, ...
+    @Override
+    protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
+        return !request.getRequestURI().startsWith("/api/");
+    }
+}

src/main/java/de/tum/cit/aet/artemis/core/security/jwt/JWTCookieService.java

@@ -5,11 +5,8 @@
 
 import java.time.Duration;
 import java.time.temporal.ChronoUnit;
-import java.util.Arrays;
-import java.util.Collection;
 
 import org.springframework.context.annotation.Profile;
-import org.springframework.core.env.Environment;
 import org.springframework.http.ResponseCookie;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Service;
@@ -18,15 +15,10 @@
 @Service
 public class JWTCookieService {
 
-    private static final String DEVELOPMENT_PROFILE = "dev";
-
     private final TokenProvider tokenProvider;
 
-    private final Environment environment;
-
-    public JWTCookieService(TokenProvider tokenProvider, Environment environment) {
+    public JWTCookieService(TokenProvider tokenProvider) {
         this.tokenProvider = tokenProvider;
-        this.environment = environment;
     }
 
     /**
@@ -59,12 +51,9 @@ public ResponseCookie buildLogoutCookie() {
      */
     private ResponseCookie buildJWTCookie(String jwt, Duration duration) {
 
-        Collection<String> activeProfiles = Arrays.asList(environment.getActiveProfiles());
-        boolean isSecure = !activeProfiles.contains(DEVELOPMENT_PROFILE);
-
         return ResponseCookie.from(JWT_COOKIE_NAME, jwt).httpOnly(true) // Must be httpOnly
-                .sameSite("Lax") // Must be Lax to allow navigation links to Artemis to work
-                .secure(isSecure) // Must be secure
+                .sameSite("None") // Must be None to allow cross-site requests to Artemis from the VS Code plugin
+                .secure(true) // Must be secure to allow sameSite=None
                 .path("/") // Must be "/" to be sent in ALL request
                 .maxAge(duration) // Duration should match the duration of the jwt
                 .build(); // Build cookie

src/main/resources/config/application.yml

@@ -291,6 +291,7 @@ jhipster:
         #exposed-headers: "Authorization,Link,X-Total-Count"
         #allow-credentials: true
         #max-age: 1800
+
     mail:
         from: artemis@localhost
     registry:

src/main/webapp/app/app.module.ts

@@ -26,6 +26,8 @@ import { ArtemisSharedComponentModule } from 'app/shared/components/shared-compo
 import { FaIconLibrary } from '@fortawesome/angular-fontawesome';
 import { artemisIconPack } from 'src/main/webapp/content/icons/icons';
 import { ScrollingModule } from '@angular/cdk/scrolling';
+import { HTTP_INTERCEPTORS } from '@angular/common/http';
+import { CsrfInterceptor } from 'app/core/csrf/csrf.interceptor';
 
 // NOTE: this module should only include the most important modules for normal users, all course management, admin and account functionality should be lazy loaded if possible
 @NgModule({
@@ -59,6 +61,7 @@ import { ScrollingModule } from '@angular/cdk/scrolling';
         SystemNotificationComponent,
         LoadingNotificationComponent,
     ],
+    providers: [{ provide: HTTP_INTERCEPTORS, useClass: CsrfInterceptor, multi: true }],
     bootstrap: [JhiMainComponent],
 })
 export class ArtemisAppModule {

src/main/webapp/app/core/csrf/csrf.interceptor.ts

@@ -0,0 +1,12 @@
+import { HttpEvent, HttpHandler, HttpInterceptor, HttpRequest } from '@angular/common/http';
+import { Observable } from 'rxjs';
+
+export class CsrfInterceptor implements HttpInterceptor {
+    intercept(req: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
+        // https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#employing-custom-request-headers-for-ajaxapi
+        // Clone the request and add the CSRF token header
+        const csrfReq = req.clone({ headers: req.headers.set('X-ARTEMIS-CSRF', 'Dennis ist schuld') });
+
+        return next.handle(csrfReq);
+    }
+}