Cherry pick of #13562 (#13579)

* Use ApiTrustRequester for SAML complete endpoint (#13562)

(cherry picked from commit c89d1435ab)

* Fix failures

api4/saml_test.go

@@ -4,7 +4,12 @@
 package api4
 
 import (
+	"net/http"
 	"testing"
+
+	"github.com/mattermost/mattermost-server/model"
+
+	"github.com/stretchr/testify/require"
 )
 
 func TestGetSamlMetadata(t *testing.T) {
@@ -17,3 +22,31 @@ func TestGetSamlMetadata(t *testing.T) {
 
 	// Rest is tested by enterprise tests
 }
+
+func TestSamlCompleteCSRFPass(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+
+	url := th.Client.Url + "/login/sso/saml"
+	req, err := http.NewRequest("POST", url, nil)
+	if err != nil {
+		return
+	}
+
+	cookie1 := &http.Cookie{
+		Name:  model.SESSION_COOKIE_USER,
+		Value: th.BasicUser.Username,
+	}
+	cookie2 := &http.Cookie{
+		Name:  model.SESSION_COOKIE_TOKEN,
+		Value: th.Client.AuthToken,
+	}
+	req.AddCookie(cookie1)
+	req.AddCookie(cookie2)
+
+	client := &http.Client{}
+	resp, err := client.Do(req)
+	require.NoError(t, err)
+	require.NotEqual(t, http.StatusUnauthorized, resp.StatusCode)
+	defer resp.Body.Close()
+}

web/handlers.go

@@ -25,6 +25,17 @@ func (w *Web) NewHandler(h func(*Context, http.ResponseWriter, *http.Request)) h
 	}
 }
 
+func (w *Web) NewHandlerTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
+	return &Handler{
+		GetGlobalAppOptions: w.GetGlobalAppOptions,
+		HandleFunc:          h,
+		RequireSession:      false,
+		TrustRequester:      true,
+		RequireMfa:          false,
+		IsStatic:            false,
+	}
+}
+
 func (w *Web) NewStaticHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
 	// Determine the CSP SHA directive needed for subpath support, if any. This value is fixed
 	// on server start and intentionally requires a restart to take effect.

web/saml.go

@@ -14,7 +14,7 @@ import (
 
 func (w *Web) InitSaml() {
 	w.MainRouter.Handle("/login/sso/saml", w.NewHandler(loginWithSaml)).Methods("GET")
-	w.MainRouter.Handle("/login/sso/saml", w.NewHandler(completeSaml)).Methods("POST")
+	w.MainRouter.Handle("/login/sso/saml", w.NewHandlerTrustRequester(completeSaml)).Methods("POST")
 }
 
 func loginWithSaml(c *Context, w http.ResponseWriter, r *http.Request) {