AIO-interface: validate Sec-Fetch-* headers

[Zoey2936]

• Resolves: Validate Sec-Fetch headers and Origin header #8600

Rules:

• all Sec-Fetch-Site "same-origin" and "none" request are allowed
• all GET Requests with Sec-Fetch-Mode "navigate" and Sec-Fetch-Dest "document" to /, /login and /containers without query params are allowed and to /api/auth/getlogin with query params.
• evertyhing else is blocked

Summary

• The PR was tested and verified that it works locally
• Or will be tested after merge on a dedicated test instance (available for maintainers)
• Sign-off message is added to all commits
• Tests (playwright if possible) are included
• Screenshots before/after for front-end changes
• Documentation has been updated or is not required
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone next added

AI (if applicable)

• The content of this PR was partly or fully generated using AI

[Zoey2936]

From #8600:

The question is: How sensitive are GET requiests to /api/auth/getlogin, /, /containers and /login? Since they would be allowed cross origin

[Zoey2936]

The code looks a bit unreadable

[szaimen]

@Zoey2936 thanks a lot! Can you please adjust the code a bit so that it gets more readable? Also please fix DCO. Thanks! :)

[Zoey2936]

done

[pabzm]

Cross-posting here, because I'm not sure where this discussion shall continue best:

The question is: How sensitive are GET requiests to /api/auth/getlogin, /, /containers and /login? Since they would be allowed cross origin

With #8765 merged I think the redirect problem is reduced to allow cross-site-requests to /api/auth/getlogin and /login, which I would be fine with.

[pabzm]

Besides disallowing /containers for cross-origin this looks good to me! (Didn't test, though)

[pabzm]

Hm, I'm not sure if we need to allow cross-origin requests to /. No external site should link to the UI, expect for the Nextcloud instance, which only uses /api/auth/getlogin and /login, as far as I can tell.

@Zoey2936 Do you have specific requests in mind for allowing that?

[Zoey2936]

Yes, this line redirects to /:

all-in-one/php/src/Controller/LoginController.php

Line 59 in 606fd7f

return $response->withHeader('Location', '../..')->withStatus(302);

(in theory it could maybe also directly redirect to /login

[pabzm]

Ah yes, I see, thank you!

[pabzm]

Looks good to me, thank you!

[Zoey2936]

Yes, this line redirects to /:

all-in-one/php/src/Controller/LoginController.php

Line 59 in 606fd7f

return $response->withHeader('Location', '../..')->withStatus(302);

(in theory it could maybe also directly redirect to /login

But maybe this could also be changed, but I'm not sure

[pabzm]

But maybe this could also be changed, but I'm not sure

I think so, too, but I'm not sure if maybe other click or code paths might lead to a redirect to /, too. So I'd prefer to keep it in, in order for users to always get to see the "login not allowed" explanation instead of the bland "Forbidden" page.

[szaimen]

LGTM. Thanks a lot! :)

[szaimen]

This is now released with v14.4.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel