Add decorator for websockets authentication

[kinow]

These changes partially address #110

The default tornado.web.authenticated decorator, with the settings from JupyterHub that we have in our application, will try to redirected unauthenticated requests to the log-in form.

This redirect may succeed if the user is already logged-in, and is using a browser. But for a JS client initiating the WebSocket communication, it fails in the backend:

RuntimeError: Method not supported for Web Sockets
2020-02-24 10:51:05,126 tornado.application ERROR    Uncaught exception GET /user/kinow/subscriptions (127.0.0.1)
HTTPServerRequest(protocol='http', host='localhost:8000', method='GET', uri='/user/kinow/subscriptions', version='HTTP/1.1', remote_ip='127.0.0.1')
Traceback (most recent call last):
  File "/home/kinow/Development/python/workspace/cylc-uiserver/venv/lib/python3.7/site-packages/tornado/websocket.py", line 956, in _accept_connection
    open_result = handler.open(*handler.open_args, **handler.open_kwargs)
  File "/home/kinow/Development/python/workspace/cylc-uiserver/venv/lib/python3.7/site-packages/tornado/web.py", line 3162, in wrapper
    url = self.get_login_url()
  File "/home/kinow/Development/python/workspace/cylc-uiserver/venv/lib/python3.7/site-packages/jupyterhub/services/auth.py", line 830, in get_login_url
    state = self.hub_auth.set_state_cookie(self, next_url=self.request.uri)
  File "/home/kinow/Development/python/workspace/cylc-uiserver/venv/lib/python3.7/site-packages/jupyterhub/services/auth.py", line 701, in set_state_cookie
    handler.set_secure_cookie(cookie_name, b64_state, **kwargs)
  File "/home/kinow/Development/python/workspace/cylc-uiserver/venv/lib/python3.7/site-packages/tornado/web.py", line 716, in set_secure_cookie
    **kwargs
  File "/home/kinow/Development/python/workspace/cylc-uiserver/venv/lib/python3.7/site-packages/tornado/websocket.py", line 627, in _raise_not_supported_for_websockets
    raise RuntimeError("Method not supported for Web Sockets")
RuntimeError: Method not supported for Web Sockets

For the WebSocket client, it's better to simply fail, and avoid polluting users' logs. So here we simply return HTTP status code 403, and log in debug level that there was an unauthenticated request to WebSocket.

Requirements check-list

• I have read CONTRIBUTING.md and added my name as a Code Contributor.
• Contains logically grouped changes (else tidy your branch by rebase).
• Does not contain off-topic changes (use other PRs for other changes).
• Appropriate tests are included (unit and/or functional).
• Appropriate change log entry included.
• I have opened a documentation PR at Adding initial docs for websockets security cylc-doc#116

[kinow]

What the logs look like if we use the tornado.web.authenticated and someone tries to open a WebSocket without logging in first.

[kinow]

Up to this point, this is the same as tornado.web.authenticated. Then after that we skip all the redirect and just log + return error.

[kinow]

And what happens if someone tries to open the connection to our /subscriptions endpoint without authenticating first (i.e. no valid cookie in the request).

(ready state 3 means connection closed - https://developer.mozilla.org/en-US/docs/Web/API/WebSocket/readyState)

[codecov-io]

Codecov Report

Merging #124 into master will increase coverage by 0.12%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master     #124      +/-   ##
==========================================
+ Coverage   52.56%   52.68%   +0.12%     
==========================================
  Files           6        6              
  Lines         371      372       +1     
  Branches       58       58              
==========================================
+ Hits          195      196       +1     
  Misses        173      173              
  Partials        3        3

Impacted Files	Coverage Δ
cylc/uiserver/handlers.py	78.2% <100%> (+0.28%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1d35ff4...5ba8f85. Read the comment docs.

[kinow]

Phew, all done! Works on my environment (famous last words), changelog created for 0.3 (which I also created and set a random release date), and a tentative documentation created too. Will ask for reviewers later after 0.2 release.

[kinow]

Rebased.

[codecov-commenter]

Codecov Report

Merging #124 into master will increase coverage by 0.12%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master     #124      +/-   ##
==========================================
+ Coverage   50.75%   50.88%   +0.12%     
==========================================
  Files           6        6              
  Lines         396      397       +1     
  Branches       64       64              
==========================================
+ Hits          201      202       +1     
  Misses        192      192              
  Partials        3        3              

Impacted Files	Coverage Δ
cylc/uiserver/handlers.py	77.38% <100.00%> (+0.27%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7e1f6df...442e298. Read the comment docs.

[dwsutherland]

LGTM, although I couldn't exactly reproduce the backend error..

I suppose I'd need to use a non-browser client I suppose?

The subscription/web-socket connection stays open when you logout at the moment..

[kinow]

I suppose I'd need to use a non-browser client I suppose?

Or create a JavaScript client, without being logged in to the UIS. Doing so, will fail as the handler won't have the authentication token.

The subscription/web-socket connection stays open when you logout at the moment..

Hmm, good point. I will test that, and if reproduced, will create an issue for that. This one should take care of authentication for the websockets, but not sure if it makes any difference after you logged out. Will confirm later with Cylc UI 👍

Thanks @dwsutherland !

[kinow]

Rebased

[hjoliver]

LGTM 👍