Backoffice Login: Move access/refresh tokens to secure cookies

[kjac]

Prerequisites

• I have added steps to test this contribution in the description below

Description

This RFC from IETF outlines best practices for web apps using token based auth moving forward.

To boil it all down, the recommendation is simply: Don't use token based auth in web apps. Or at the very least, don't expose tokens to web apps.

The reason? Malicious scripts and even browser extensions means there's the risk of token theft.

We cannot remove the token based auth from the Umbraco back-office client "just like that", because it would be rather breaking. Instead, we're putting a multi-step plan in motion to first stop exposing the tokens, and then phase them out later on.

This PR is the first step. It adds a configurable option to redact access and refresh tokens from the server.

As the PR targets 16.4, it must be backwards compatible (non-breaking). Thus, the feature is disabled by default. It is of course recommended to enable the feature, and the Umbraco docs will reflect that.

A follow-up PR will cherry-pick the feature into 17.0 and make it mandatory.

New configuration

This PR adds the BackOfficeTokenCookie configuration options to Umbraco:CMS:Security:

{
  "Umbraco": {
    "CMS": {
      "Security": {
        "BackOfficeTokenCookie": {
          "Enabled": false,
          "SameSite": "Strict" // Valid values are "Unspecified", "None", "Lax" and "Strict" (default).
        }
      }
    }
  }
}

To enable the feature, set Enabled to true.

The SameSite configuration is necessary when hosting the back-office client on a different host from the Management API. This is a common development practice - we have yet to see anyone doing it in production.

Regardless of changing the SameSite configuration, the generated token cookies still follow the security recommendations from the RFC. Of course, Strict mode (the default) is better than None.

Note

Some might be running Umbraco without HTTPS in development environments. If this is the case, the cookie cannot be marked as secure, which is in violation with the above-mentioned security recommendations.

It is not possible to run Umbraco without HTTPS in production mode, unless you explicitly add code to prevent the boot time checking of HTTPS, so production environments should always have secure cookies.

Testing this PR

Start by running the site without any configuration changes. It should work as per usual, and you should still see access and refresh tokens in the Management API requests from the back-office client.

Now enable the feature and restart the site. Log out and log back in to ensure the feature is invoked. Everything should still work the same.

All the Management API requests from the back-office client should still contain an Authorization header, but the access token should have the value [redacted].

Similarly, refresh token requests should contain a [redacted] refresh token in the payload. You can trigger a refresh token request by reloading the browser - look for requests to the /token endpoint.

Lastly, verify that two cookies prefixed with __Host-umb have been accepted by the client. They should be secure, HTTP-only session cookies, and they should contain an encrypted representation of access and refresh tokens - not valid tokens in clear text.

[AndyButland]

This looks good to me @kjac. I've tested it on a local site using the build artifacts from this PR. I used the Personalisation Groups package which has it's own management API. and this all looks to work OK (from the backoffice and also via the Swagger UI).

[iOvergaard]

Just for good measure, knowing that I created some of the code, I'll put my checkmark here.

I have tested the following:

• ✅ The token-approach (no cookies) still works
• ✅ The new approach works on the compiled backoffice
• ✅ It works on the Vite dev server (if you set SameSite=None)
• ✅ It works with SameSite=Strict, too, if you add the @vite/basic-ssl library to the Vite dev server and run the backend and Vite on https://localhost:xxxx
• ✅ The preview mode still works and carries over the token to a new tab
• ✅ Custom controllers work if they provide the security filter
• ✅ Custom fetch clients work if they provide credentials: 'include'
• ✅ The umbraco-extension template (still) works out-of-the-box (no changes required)

[leekelleher]

Tested out with Contentment (v6-beta001), all working as expected! 🚀

[umbracocommunity]

This pull request has been mentioned on Umbraco community forum. There might be relevant details there:

https://forum.umbraco.com/t/backoffice-login/7075/2