work around the csrf filter for app-to-app requests by sending the requesting app's domain in the Origin header

This makes the request appear like a CORS request sent by a browser, and if the origin is in the CORS whitelist will be accepted by the receiving server without a further CSRF check. CSRF checks are going to be a pain for server-to-server requests (and technically not required, but there's no clear way to safely disable them for server-to-server requests and not browser-to-server requests)

Author: andrew-nowak

common-lib/src/main/scala/com/gu/mediaservice/GridClient.scala

@@ -38,8 +38,8 @@ object ClientResponse {
 case class ClientErrorMessages(errorMessage: String, downstreamErrorMessage: String)
 
 object GridClient extends LazyLogging {
-  def apply(services: Services)(implicit wsClient: WSClient): GridClient =
-    new GridClient(services)
+  def apply(services: Services, originUri: String)(implicit wsClient: WSClient): GridClient =
+    new GridClient(services, originUri)
 
   sealed trait Response {
     def status: Int
@@ -96,7 +96,7 @@ object GridClient extends LazyLogging {
 
 }
 
-class GridClient(services: Services)(implicit wsClient: WSClient) extends LazyLogging {
+class GridClient(services: Services, originDomain: String)(implicit wsClient: WSClient) extends LazyLogging {
 
   /*
    * `requestTimeout` will set the max duration of the request before timing out. You may also want to increase the
@@ -255,14 +255,14 @@ class GridClient(services: Services)(implicit wsClient: WSClient) extends LazyLo
 
   def postUsage(usageType: String, data: JsObject, authFn: WSRequest => WSRequest)(implicit ec: ExecutionContext) = {
     val url = new URL(s"${services.usageBaseUri}/usages/$usageType")
-    val request: WSRequest = wsClient.url(url.toString)
+    val request: WSRequest = wsClient.url(url.toString).withHttpHeaders(("Origin", originDomain))
     val authorisedRequest = authFn(request)
     authorisedRequest.post(Json.obj("data" -> data)).map { response => validateResponse(response, url)}
   }
 
   def putArchived(mediaId: String, authFn: WSRequest => WSRequest)(implicit ec: ExecutionContext) = {
     val url = new URL(s"${services.metadataBaseUri}/metadata/$mediaId/archived")
-    val request = authFn(wsClient.url(url.toString))
+    val request = authFn(wsClient.url(url.toString).withHttpHeaders(("Origin", originDomain)))
     request.put(Json.obj("data" -> JsTrue)).map { response => validateResponse(response, url)}
   }
 }

image-loader/app/ImageLoaderComponents.scala

@@ -21,7 +21,7 @@ class ImageLoaderComponents(context: Context) extends GridComponents(context, ne
     logger.info(s" $index -> ${processor.description}")
   }
 
-  private val gridClient = GridClient(config.services)(wsClient)
+  private val gridClient = GridClient(config.services, config.services.loaderBaseUri)(wsClient)
 
   val store = new ImageLoaderStore(config)
   val maybeIngestQueue = config.maybeIngestSqsQueueUrl.map(queueUrl => new SimpleSqsMessageConsumer(queueUrl, config))

media-api/app/controllers/MediaApi.scala

@@ -50,7 +50,7 @@ class MediaApi(
 )(implicit val ec: ExecutionContext) extends BaseController with MessageSubjects with ArgoHelpers with ContentDisposition {
 
   val services: Services = new Services(config.domainRoot, config.serviceHosts, Set.empty)
-  val gridClient: GridClient = GridClient(services)(ws)
+  val gridClient: GridClient = GridClient(services, services.apiBaseUri)(ws)
 
   // Process-local cache keyed on normalised query text. Stores the Bedrock Future so that
   // concurrent requests for the same query share a single in-flight Bedrock call, and

metadata-editor/app/controllers/EditsController.scala

@@ -59,7 +59,7 @@ class EditsController(
   import com.gu.mediaservice.lib.metadata.UsageRightsMetadataMapper.usageRightsToMetadata
 
   val services: Services = new Services(config.domainRoot, config.serviceHosts, Set.empty)
-  val gridClient: GridClient = GridClient(services)(ws)
+  val gridClient: GridClient = GridClient(services, services.metadataBaseUri)(ws)
 
   val metadataBaseUri = config.services.metadataBaseUri
   private val AuthenticatedAndAuthorised = auth andThen authorisation.CommonActionFilters.authorisedForArchive

thrall/app/ThrallComponents.scala

@@ -31,7 +31,7 @@ class ThrallComponents(context: Context) extends GridComponents(context, new Thr
   es.ensureIndexExistsAndAliasAssigned()
 
   val services: Services = new Services(config.domainRoot, config.serviceHosts, Set.empty)
-  val gridClient: GridClient = GridClient(services)(wsClient)
+  val gridClient: GridClient = GridClient(services, services.thrallBaseUri)(wsClient)
 
   // before firing up anything to consume streams or say we are OK let's do the critical good to go check
   private val goodToGoCheckResult = Await.ready(GoodToGoCheck.run(es), 30 seconds)