[10-10CG] Ensure we have a valid csrf token when making POST requests in 10-10CG #34395

coope93 · 2025-01-30T15:26:03Z

Note: Delete the description statements, complete each step. None are optional, but can be justified as to why they cannot be completed as written. Provide known gaps to testing that may raise the risk of merging to production.

Are you removing, renaming or moving a folder in this PR?

No, I'm not changing any folders (skip to TeamSites and delete the rest of this section)
Yes, I'm removing, renaming or moving a folder

If the folder you changed contains a manifest.json, search for its entryName in the content-build registry.json (the entryName there will match).

If an entry for this folder exists in content-build and you are:

Deleting a folder:
1. First search vets-website for all instances of the entryName in your manifest.json and remove them in a separate PR. Look particularly for references in src/applications/static-pages/static-pages-entry.js and src/platform/forms/constants.js. If you do not do this, other applications will break!
  - Add the link to your merged vets-website PR here
2. Then, Delete the application entry in registry.json and merge that PR before this one
  - Add the link to your merged content-build PR here
Renaming or moving a folder: Update the entry in the registry.json, but do not merge it until your vets-website changes here are merged. The content-build PR must be merged immediately after your vets-website change is merged in to avoid CI errors with content-build (and Tugboat).

⚠️ TeamSites ⚠️

Examples of a TeamSite: https://va.gov/health and https://benefits.va.gov/benefits/. This scenario is also referred to as the "injected" header and footer. You can reach out in the #sitewide-public-websites Slack channel for questions.

Did you change site-wide styles, platform utilities or other infrastructure?

No
Yes, and I used the proxy-rewrite steps to test the injected header scenario

Summary

Pulling out the logic we introduced to make a HEAD request to generate a new csrf token when it is absent from localStorage in the fetchFacilities function.
Created a new ensureValidCSRFToken function that checks if the csrf token is in local storage, and if it is not it makes the HEAD request to generate a new one.
Using this new function in the fetchFacilities function and in the ApplicationDownloadLink component that makes a POST call to generate a pdf for download.
This is a first step to use this method in more than one place, and the eventual goal is to integrate it into the existing apiRequest function.
I wanted to get it in and prove that it is working for the ApplicationDownloadLink since we have consistently been seeing 403 invalid csrf errors for years on this call, and I think getting it in to validate it here sooner is better than waiting to ensure we have the right approach to introduce it sitewide via the apiRequest function.
1010 Health Apps

Related issue(s)

Testing done

Updated the unit tests to for the new function and where it is used
We will manually validate the request is being sent when there is no csrf token in a RI before merging

Screenshots

No UI changes

What areas of the site does it impact?

10-10CG

Acceptance criteria

Quality Assurance & Testing

I fixed|updated|added unit tests and integration tests for each feature (if applicable).
No sensitive information (i.e. PII/credentials/internal URLs/etc.) is captured in logging, hardcoded, or specs
Linting warnings have been addressed
Documentation has been updated (link to documentation *if necessary)
Screenshot of the developed feature is added
Accessibility testing has been performed

Error Handling

Browser console contains no warnings or errors.
Events are being sent to the appropriate logging solution
Feature/bug has a monitor built into Datadog or Grafana (if applicable)

Authentication

Did you login to a local build and verify all authenticated routes work as expected with a test user

…dCSRFToken

coope93 · 2025-01-30T19:36:47Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+    });
+};
+
+export const ensureValidCSRFToken = async () => {


Same logic we had in the fetchFacilities, just moved it here so it can be reused. Maybe there is a better place than actions? It's really a helper, but I'm also hoping it does not stay here super long as we will want to eventually get it somewhere more global.

coope93 · 2025-01-30T19:37:19Z

src/applications/caregivers/tests/unit/actions/fetchFacilities.unit.spec.js

@@ -155,69 +141,6 @@ describe('CG fetchFacilities action', () => {
        expect(apiRequestStub.callCount).to.equal(1);
      });
    });
-
-    context('no csrfToken in localStorage', () => {


This is all tested in the unit spec for the new ensureValidCSRFToken

va-vfs-bot

Sentry call found

Sentry captures a lot of data, and we want to make sure that we only keep information that will be useful for troubleshooting issues. This means that PII should not be recorded.

What you can do

Review your call to Sentry and see if you can reasonably reduce any information that is included, or wait for a VSP review.

va-vfs-bot · 2025-01-30T19:58:32Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+    event: 'caregivers-10-10cg-fetch-csrf-token-empty',
+  });
+
+  Sentry.withScope(scope => {


Sentry found

va-vfs-bot · 2025-01-30T19:58:33Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+  });
+
+  Sentry.withScope(scope => {
+    scope.setLevel(Sentry.Severity.Log);


Sentry found

va-vfs-bot · 2025-01-30T19:58:33Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+
+  Sentry.withScope(scope => {
+    scope.setLevel(Sentry.Severity.Log);
+    Sentry.captureMessage(`${message} Calling ${url} to generate new one.`);


Sentry found

va-vfs-bot · 2025-01-30T19:58:33Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+
+  return apiRequest(`${environment.API_URL}${url}`, { method: 'HEAD' })
+    .then(() => {
+      Sentry.withScope(scope => {


Sentry found

va-vfs-bot · 2025-01-30T19:58:33Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+  return apiRequest(`${environment.API_URL}${url}`, { method: 'HEAD' })
+    .then(() => {
+      Sentry.withScope(scope => {
+        scope.setLevel(Sentry.Severity.Log);


Sentry found

va-vfs-bot · 2025-01-30T19:58:33Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+    .then(() => {
+      Sentry.withScope(scope => {
+        scope.setLevel(Sentry.Severity.Log);
+        Sentry.captureMessage(


Sentry found

va-vfs-bot · 2025-01-30T19:58:33Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+      });
+    })
+    .catch(error => {
+      Sentry.withScope(scope => {


Sentry found

va-vfs-bot · 2025-01-30T19:58:33Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+    })
+    .catch(error => {
+      Sentry.withScope(scope => {
+        scope.setLevel(Sentry.Severity.Log);


Sentry found

va-vfs-bot · 2025-01-30T19:58:33Z

src/applications/caregivers/actions/ensureValidCSRFToken.js

+      Sentry.withScope(scope => {
+        scope.setLevel(Sentry.Severity.Log);
+        scope.setExtra('error', error);
+        Sentry.captureMessage(


Sentry found

coope93 added 4 commits January 30, 2025 09:44

pull out refresh csrf request to own action

239a6e9

use ensureValidCSRFToken in fetchFacilities

5c570f0

add ensureValidCSRFToken to downloadlink component

6e2fd0b

Remove specs that were already tested in the unit spec for ensureVali…

b4e9f77

…dCSRFToken

coope93 changed the title ~~Coope93 ensure valid csrf token~~ [10-10CG] Ensure we have a valid csrf token when making POST requests in 10-10CG Jan 30, 2025

coope93 commented Jan 30, 2025

View reviewed changes

coope93 marked this pull request as ready for review January 30, 2025 19:57

coope93 requested review from a team as code owners January 30, 2025 19:57

va-vfs-bot reviewed Jan 30, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[10-10CG] Ensure we have a valid csrf token when making POST requests in 10-10CG #34395

[10-10CG] Ensure we have a valid csrf token when making POST requests in 10-10CG #34395

coope93 commented Jan 30, 2025 •

edited

Loading

coope93 Jan 30, 2025

coope93 Jan 30, 2025

va-vfs-bot left a comment

va-vfs-bot Jan 30, 2025

va-vfs-bot Jan 30, 2025

va-vfs-bot Jan 30, 2025

va-vfs-bot Jan 30, 2025

va-vfs-bot Jan 30, 2025

va-vfs-bot Jan 30, 2025

va-vfs-bot Jan 30, 2025

va-vfs-bot Jan 30, 2025

va-vfs-bot Jan 30, 2025

[10-10CG] Ensure we have a valid csrf token when making POST requests in 10-10CG #34395

Are you sure you want to change the base?

[10-10CG] Ensure we have a valid csrf token when making POST requests in 10-10CG #34395

Conversation

coope93 commented Jan 30, 2025 • edited Loading

Are you removing, renaming or moving a folder in this PR?

⚠️ TeamSites ⚠️

Summary

Related issue(s)

Testing done

Screenshots

What areas of the site does it impact?

Acceptance criteria

Quality Assurance & Testing

Error Handling

Authentication

Choose a reason for hiding this comment

Choose a reason for hiding this comment

va-vfs-bot left a comment

Choose a reason for hiding this comment

Sentry call found

What you can do

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

coope93 commented Jan 30, 2025 •

edited

Loading