[P4-2419] Ensure form wizards are unique for each Person Escort Record #946
Conversation
Currently we use a generic session key for the form wizard and its journeys. This means that the session is shared for all Person Escort Records. This leads to an occurrance of CSRF resets and clashes when opening an old record to compare against a new record. To prevent this, each form-wizard and journey is given a unique name using the ID of the record.
The content displayed on the error page when a form has been tampered with currently instructs the user to reload the page. However, with a number of modern browsers this will use the original request method, in this case a `POST`, which will cause the error to continue to appear. This change adds a link to the instruction that will force the browser to reload this page with a `GET` which will regenerate the CSRF token and prevent the error from re-appearing.
teneightfive
force-pushed
the
fix/csrf
branch
from
62cd378 to
4dbcca7
Compare
|
Code Climate has analyzed commit 4dbcca7 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (90% is the threshold). This pull request will bring the total coverage in the repository to 97.8% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Approved, with the caveats raised in our chat - namely this is tweaking how these form/journey names are being used so we might have issues down the line, and that we get a browser test to validate that this fixes the multiple tabs issue so that we're protected from regressions in the future
Have added #950 to track this follow up test |
Proposed changes
What changed
This change uses the ID of the Person Escort Record to create the form wizard and journey keys so that they are unique for each record.
This also introduces a link to the error page to make it easier to refresh a form that has been tampered with.
Why did it change
We have seen lots of CSRF errors reported in Sentry. This occurs when a new CSRF token is generating for that form wizard and its journey.
Currently the key is not unique per Person Escort Record form wizard which means that if a user opens an existing record in another tab, for example to compare the previous information or re-use some information, and then try and submit the form step, it will have regenerated the CSRF token and the initial form step will now error.
Issue tracking
Screenshots
Checklists
Testing
Automated testing
Manual testing
Has been tested in the following browsers:
Environment variables
Other considerations
Commit messages with a
fixorfeattype are automatically used to generate the changelog andGitHub release notes during the release task. Please make sure they will read well on their own in a
summary of changes and that the commit body gives a more detailed description of those changes if necessary.