Support for Cookie authentication (#390)

- Added support for cookie authentication (authorization header will have priority)
- Removed local storage token management from UI
- cookie hardening (sameSite, httpOnly, secure)
- login endpoint sets cookie via header, logout endpoint expires cookie
- Refactor Routes and ProtectedRoutes components, improvement on the way
  application check if user session is valid

Future improvements

- look for all places in backend that returns 401 unauthorized, and destroy session there (not a priority since cookie its invalid anyway)
- Downloading objects in object browser can be simplified since is just a GET request and users will be authenticated via Cookies, no need to craft additional requests

restapi/utils.go

@@ -19,8 +19,10 @@ package restapi
 import (
 	"crypto/rand"
 	"io"
+	"net/http"
 	"os"
 	"strings"
+	"time"
 )
 
 // Do not use:
@@ -102,3 +104,37 @@ func FileExists(filename string) bool {
 	}
 	return !info.IsDir()
 }
+
+func NewSessionCookieForConsole(token string) http.Cookie {
+	expiration := time.Now().Add(SessionDuration)
+
+	return http.Cookie{
+		Path:     "/api", // browser will send cookie only for HTTP request under api path
+		Name:     "token",
+		Value:    token,
+		MaxAge:   int(SessionDuration.Seconds()), // 45 minutes
+		Expires:  expiration,
+		HttpOnly: true,
+		// if len(GlobalPublicCerts) > 0 is true, that means Console is running with TLS enable and the browser
+		// should not leak any cookie if we access the site using HTTP
+		Secure: len(GlobalPublicCerts) > 0,
+		// read more: https://web.dev/samesite-cookies-explained/
+		SameSite: http.SameSiteLaxMode,
+	}
+}
+
+func ExpireSessionCookie() http.Cookie {
+	return http.Cookie{
+		Path:     "/api", // browser will send cookie only for HTTP request under api path
+		Name:     "token",
+		Value:    "",
+		MaxAge:   -1,
+		Expires:  time.Now().Add(-100 * time.Hour),
+		HttpOnly: true,
+		// if len(GlobalPublicCerts) > 0 is true, that means Console is running with TLS enable and the browser
+		// should not leak any cookie if we access the site using HTTP
+		Secure: len(GlobalPublicCerts) > 0,
+		// read more: https://web.dev/samesite-cookies-explained/
+		SameSite: http.SameSiteLaxMode,
+	}
+}