[MM-10346] CSRF Token Implementation + Tests (#10067)

* CSRF Token Implementation + Tests

Remove debug statements

Implement requested changes

* Fix non-cookie authentication methods stripping auth data from requests

* Fail when CSRF cookie is not returned as part of login

api4/user_test.go

@@ -6,6 +6,7 @@ package api4
 import (
 	"net/http"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -27,7 +28,22 @@ func TestCreateUser(t *testing.T) {
 	CheckNoError(t, resp)
 	CheckCreatedStatus(t, resp)
 
-	th.Client.Login(user.Email, user.Password)
+	_, resp = th.Client.Login(user.Email, user.Password)
+	session, _ := th.App.GetSession(th.Client.AuthToken)
+	expectedCsrf := "MMCSRF=" + session.GetCSRF()
+	actualCsrf := ""
+
+	for _, cookie := range resp.Header["Set-Cookie"] {
+		if strings.HasPrefix(cookie, "MMCSRF") {
+			cookieParts := strings.Split(cookie, ";")
+			actualCsrf = cookieParts[0]
+			break
+		}
+	}
+
+	if expectedCsrf != actualCsrf {
+		t.Errorf("CSRF Mismatch - Expected %s, got %s", expectedCsrf, actualCsrf)
+	}
 
 	if ruser.Nickname != user.Nickname {
 		t.Fatal("nickname didn't match")