Fixed Cookie Authentication

[sudiptosarkar]

Fixes for Cookie Authentication. This builds on top of the changes done as part of the issue #8683 (PR #8689) and #9710. The changes done as part of that PR don't work (both setting the Cookie as well as resetting it).

Description

• Fixed Cookie Removal for Logouts
• Fixed Setting of Cookie by specifying the path
• Adding secure only when target is SSL/TLS
• Added Unit Tests

Motivation and Context

The Cookie based Authentication was not working in at least Safari. Neither was the cookie being set, nor was was it being unset (after fixing the setting part). This was causing the API testing of Cookie Authentication based endpoints impossible.

The official Mozilla Developer Documentation on document.cookie was followed to implement the fix.

Swagger UI's official documentation states that cross domain Cookie Auth is not supported. While that may still be the case after this fix is released because of CORS blocks, this fix will work if the swagger UI is loaded from the same domain, where the APIs reside.

Fixes for removing the set Cookies have also been added

How Has This Been Tested?

• A cookie authentication based nodejs application was used with swagger-express-ui.
• The persistAuthorization configuration field was set to true
• After deploying the application, the Authentication Cookie was set.
• API endpoints were hit using these browsers:
  • Mozilla Firefox
  • Google Chrome
  • Safari
  • Microsoft Edge
• The Cookie Request Header was verified to have an entry for the authentication cookie
• Logout was tested in the same manner.

Screenshots (if appropriate):

Checklist

My PR contains...

• No code changes (src/ is unmodified: changes to documentation, CI, metadata, etc.)
• Dependency changes (any modification to dependencies in package.json)
• Bug fixes (non-breaking change which fixes an issue)
• Improvements (misc. changes to existing features)
• Features (non-breaking change which adds functionality)

My changes...

• are breaking changes to a public API (config options, System API, major UI change, etc).
• are breaking changes to a private API (Redux, component props, utility functions, etc.).
• are breaking changes to a developer API (npm script behavior changes, new dev system dependencies, etc).
• are not breaking changes.

Documentation

• My changes do not require a change to the project documentation.
• My changes require a change to the project documentation.
• If yes to above: I have updated the documentation accordingly.

Automated tests

• My changes can not or do not need to be tested.
• My changes can and should be tested by unit and/or integration tests.
• If yes to above: I have added tests to cover my changes.
• If yes to above: I have taken care to cover edge cases in my tests.
• All new and existing tests passed.