Improve our authentication

[jbriones1]

TL;DR We probably need to re-do our authentication.

Look at the implementation section for how we could implement it
https://fastapi.tiangolo.com/advanced/security/oauth2-scopes/
https://www.rfc-editor.org/rfc/rfc7519#section-10.1
https://www.rfc-editor.org/rfc/rfc8725

Description

I think our backend should be frontend agnostic, which means we should probably improve how we handle sessions. We could also share sessions between different applications across the CSSS. This will require us to rewrite how our authentication flow works. Since we rely on SFU's CAS system, we would just need to adapt how our sessions are managed.

Problems and Solution

There are a number of problems with our current implementation.

1. Strings are handled poorly

We need to check things are encoded properly and that the POST body from login is not malicious.

Solutions

• (login_user) Remove redirect_url, just redirect to the https://admin.sfucsss.org for now,
• (login_user) urllib.parse.quote(body.ticket) as well, just like service

2. Cleaning up expired sessions from the database is reliant on logins

If someone's session expires then it sits in the database until someone else logs in and the sessions are checked.

Solutions

• Add a CRON job that will sweep the user_session table regularly #152

3. Site user pics are vulnerable to XSS

People could upload pictures that is actually malicious code.

Solution

• Remove site user pictures from the database and web server.

4. Logging in invalidates previous sessions

That means if someone has multiple tabs open they could be logged out of their session on certain tabs.

Solution

• Either we add Single Sign On (SSO) for all of our apps, but we only really care about the admin app, so just restrict the application to just that for now.

5. Session IDs are way too big

It's 256 bytes right now, which is apparently way too big.

Solution

• Change it to use 32 bytes of entropy
• Update the database table column to use the session ID new size
• Update the Pydantic models to use the new session ID size

6. No rate-limiting to our login endpoint

Our web server could be used to DoS the SFU CAS servers. This will probably need to be handled on Nginx.

Solution

• Explore rate-limiting #153