feat(router): CSRF Prevention

[ardatan]

Closes #321
Ref ROUTER-114

[gemini-code-assist]

Summary of Changes

Hello @ardatan, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the security posture of the router by implementing a robust CSRF prevention mechanism. It allows for the configuration of required HTTP headers, which are then validated early in the request pipeline to ensure that incoming requests are legitimate and not part of a Cross-Site Request Forgery attack. This feature provides an essential layer of protection against malicious requests, improving the overall integrity and security of the application.

Highlights

• New CSRF Prevention Mechanism: Introduced a new module csrf_prevention.rs that implements logic to prevent Cross-Site Request Forgery (CSRF) attacks by checking for specific headers in incoming requests.
• Configurable Required Headers: The CSRF prevention mechanism is configurable, allowing users to specify a list of required_headers that must be present in requests. This configuration is defined in lib/router-config/src/csrf.rs and integrated into the main router configuration.
• Pipeline Integration: The CSRF prevention check is integrated early into the request processing pipeline within bin/router/src/pipeline/mod.rs, ensuring that requests are validated before further processing.
• Error Handling: A new error variant PipelineErrorVariant::CsrfPreventionFailed has been added to bin/router/src/pipeline/error.rs, which results in a 403 Forbidden HTTP status code when a CSRF check fails.
• Documentation Update: The docs/README.md has been updated to include detailed information and examples for configuring the new CSRF prevention feature.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces CSRF prevention, a valuable security enhancement. The implementation is mostly solid, adding a new configuration option and integrating the check into the request pipeline. I've provided a few suggestions to improve the efficiency of a header check, and to enhance the clarity of the documentation and code comments. Overall, this is a great addition.

[github-actions]

✅ k6-benchmark results

     ✓ response code was 200
     ✓ no graphql errors
     ✓ valid response structure

     █ setup

     checks.........................: 100.00% ✓ 233019      ✗ 0    
     data_received..................: 6.8 GB  227 MB/s
     data_sent......................: 91 MB   3.0 MB/s
     http_req_blocked...............: avg=3.18µs   min=651ns   med=1.72µs  max=15.22ms  p(90)=2.45µs  p(95)=2.8µs   
     http_req_connecting............: avg=474ns    min=0s      med=0s      max=2.11ms   p(90)=0s      p(95)=0s      
     http_req_duration..............: avg=18.83ms  min=1.91ms  med=17.91ms max=79.75ms  p(90)=26.06ms p(95)=29.23ms 
       { expected_response:true }...: avg=18.83ms  min=1.91ms  med=17.91ms max=79.75ms  p(90)=26.06ms p(95)=29.23ms 
     http_req_failed................: 0.00%   ✓ 0           ✗ 77693
     http_req_receiving.............: avg=136.33µs min=25.15µs med=39.33µs max=39.4ms   p(90)=88.36µs p(95)=355.91µs
     http_req_sending...............: avg=24.51µs  min=5.48µs  med=10.6µs  max=30.27ms  p(90)=16.16µs p(95)=29.19µs 
     http_req_tls_handshaking.......: avg=0s       min=0s      med=0s      max=0s       p(90)=0s      p(95)=0s      
     http_req_waiting...............: avg=18.67ms  min=1.85ms  med=17.78ms max=77.01ms  p(90)=25.8ms  p(95)=28.91ms 
     http_reqs......................: 77693   2584.409608/s
     iteration_duration.............: avg=19.3ms   min=4.82ms  med=18.27ms max=215.31ms p(90)=26.49ms p(95)=29.75ms 
     iterations.....................: 77673   2583.74432/s
     vus............................: 50      min=50        max=50 
     vus_max........................: 50      min=50        max=50 

[github-actions]

🐋 This PR was built and pushed to the following Docker images:

Image Names: ghcr.io/graphql-hive/router

Platforms: linux/amd64,linux/arm64

Image Tags: ghcr.io/graphql-hive/router:pr-472 ghcr.io/graphql-hive/router:sha-47824a4

Docker metadata

{
"buildx.build.ref": "builder-a8635f61-eeaa-4d9a-9474-2d643e657761/builder-a8635f61-eeaa-4d9a-9474-2d643e6577610/yicp5okaid0myvde50wcfyt91",
"containerimage.descriptor": {
  "mediaType": "application/vnd.oci.image.index.v1+json",
  "digest": "sha256:87c86d4815a19d1cc1ddc714751564b4c47c5e7c1e2ce33722fe56a9428699ed",
  "size": 1609
},
"containerimage.digest": "sha256:87c86d4815a19d1cc1ddc714751564b4c47c5e7c1e2ce33722fe56a9428699ed",
"image.name": "ghcr.io/graphql-hive/router:pr-472,ghcr.io/graphql-hive/router:sha-47824a4"
}

[kamilkisiela]

Are you sure:

csrf:
  required_headers:
    - X-CsRf-ToKeN

will work the same way as x-csrf-token?

Maybe it's worth adding a normalization step to the config? Like when the config is loaded and serde deserializes it, the list of strings (headers) is normalized (lowercased).

[ardatan]

You're right. Let me do it.

[ardatan]

I added tests and it seems to work correctly.
https://github.com/graphql-hive/router/blob/csrf-prevention/bin/router/src/pipeline/csrf_prevention.rs#L125

[kamilkisiela]

I made some changes