topazoo/flongo-stack

Flongo Client + Flongo Framework | iOS/macOS/Web Frontend + Flask/MongoDB Backend

flongo-stack's Issues

Invalid CSRF on De-Authentication

When CSRF validation is enabled on the server side, there is an issue logging users out from the client (Chrome at least) using the navbar. When a request is submitted the following error is displayed:

[2024-01-07 23:09:14]:INFO:routing:[/authenticate]:[DELETE]:* Recieved HTTP DELETE request *
[2024-01-07 23:09:14]:ERROR:routing:[/authenticate]:[DELETE]:* Error: CSRF double submit tokens do not match
[2024-01-07 23:09:14]:DEBUG:routing:[/authenticate]:[DELETE]:Traceback (most recent call last):
  File "/usr/local/lib/python3.10/site-packages/flongo_framework/api/routing/handlers/route_handler.py", line 98, in handler
    wrapped_request.set_identity(Authentication_Util.validate_identity_cookie_role(required_roles))
  File "/usr/local/lib/python3.10/site-packages/flongo_framework/api/routing/utils/authentication_util.py", line 25, in validate_identity_cookie_role
    if not (current_identity:=cls.get_current_identity()):
  File "/usr/local/lib/python3.10/site-packages/flongo_framework/api/routing/utils/authentication_util.py", line 62, in get_current_identity
    verify_jwt_in_request(optional=True)
  File "/usr/local/lib/python3.10/site-packages/flask_jwt_extended/view_decorators.py", line 94, in verify_jwt_in_request
    jwt_data, jwt_header, jwt_location = _decode_jwt_from_request(
  File "/usr/local/lib/python3.10/site-packages/flask_jwt_extended/view_decorators.py", line 340, in _decode_jwt_from_request
    decoded_token = decode_token(encoded_token, csrf_token)
  File "/usr/local/lib/python3.10/site-packages/flask_jwt_extended/utils.py", line 128, in decode_token
    return jwt_manager._decode_jwt_from_config(encoded_token, csrf_value, allow_expired)
  File "/usr/local/lib/python3.10/site-packages/flask_jwt_extended/jwt_manager.py", line 556, in _decode_jwt_from_config
    return _decode_jwt(**kwargs, allow_expired=allow_expired)
  File "/usr/local/lib/python3.10/site-packages/flask_jwt_extended/tokens.py", line 122, in _decode_jwt
    raise CSRFError("CSRF double submit tokens do not match")
flask_jwt_extended.exceptions.CSRFError: CSRF double submit tokens do not match

A followup logout request via the navbar seems to fire just fine so it is unclear exactly what is being submitted on the client side to warrant this. But with some tracing it should be possible to determine what if any CSRF token is being sent and why it doesn't line up