chore: swagger docs omit brower based credentials, rely on swagger auth (#13742)

* chore: swagger docs omit brower based credentials, rely on swagger auth

Swagger has an "Authorize" button which should be the only
authentication being used in the api requests

coderd/httpmw/csrf.go

@@ -1,6 +1,7 @@
 package httpmw
 
 import (
+	"fmt"
 	"net/http"
 	"regexp"
 	"strings"
@@ -20,6 +21,20 @@ func CSRF(secureCookie bool) func(next http.Handler) http.Handler {
 		mw := nosurf.New(next)
 		mw.SetBaseCookie(http.Cookie{Path: "/", HttpOnly: true, SameSite: http.SameSiteLaxMode, Secure: secureCookie})
 		mw.SetFailureHandler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			sessCookie, err := r.Cookie(codersdk.SessionTokenCookie)
+			if err == nil && r.Header.Get(codersdk.SessionTokenHeader) != sessCookie.Value {
+				// If a user is using header authentication and cookie auth, but the values
+				// do not match, the cookie value takes priority.
+				// At the very least, return a more helpful error to the user.
+				http.Error(w,
+					fmt.Sprintf("CSRF error encountered. Authentication via %q cookie and %q header detected, but the values do not match. "+
+						"To resolve this issue ensure the values used in both match, or only use one of the authentication methods. "+
+						"You can also try clearing your cookies if this error persists.",
+						codersdk.SessionTokenCookie, codersdk.SessionTokenHeader),
+					http.StatusBadRequest)
+				return
+			}
+
 			http.Error(w, "Something is wrong with your CSRF token. Please refresh the page. If this error persists, try clearing your cookies.", http.StatusBadRequest)
 		}))