CSRF Protection Added

[Sharath-a26]

• A 32-bit CSRF Token will be generated when logged in. Added to both response X-CSRF-Token header and to the cookie.
• Requests that are not authenticated i.e Login, Register etc. need not pass the token in header
• Created a middleware CSRFMiddleWare in util to check whether cookie and header token matches.

[Sharath-a26]

@Ashrockzzz2003 Please review and let me know If I need to make any changes

[Ashrockzzz2003]

can we hide it behind a feature flag (env var)?
the other evoc services make requests to this auth and they might not work without changes there.

[Sharath-a26]

Sure, so if that var is set to false, the whole CSRF is disabled. Something like that right?

[Ashrockzzz2003]

Yes

[Sharath-a26]

Done with that change @Ashrockzzz2003

[Ashrockzzz2003]

Thanks Sharath
But you need to add csrf to controller/grpc/authenticate.go too as this is the function that'll be called via grpc by other microservices to authenticate requests.