Zac Bergquist e356649f3c Complete CSRF cleanup for Teleport 18 (#50534) ...

* Restore CSRF Token for SSO flows

This is a partial revert of #50358.
We need to keep the CSRF token in the SSO flows for now, as it is
used to ensure that the flow is completed by the same actor who
initiated the sign-on.

* Make the purpose of the lib/httplib/csrf package clear

This package is only used to protect against login CSRF with SSO flows.

Teleport's web API is protected from CSRF by nature of using a bearer
token, and does not require this package. This particular pacakge is
only necessary for SSO because the user is not yet logged in when the
SSO flow begins, so they don't have a bearer token.

* Remove the remaining bits of unneeded CSRF code

Additionally expand upon the godocs for our various middlewares
so that it's clear which ones provide CSRF protection.

2024-12-30 15:38:24 +00:00

..

csrf.go

…