[PUI] Use sessions backend for login

[matmair]

Removes the usage of API tokens for PUI - switches to CSRF and session token.

Fixes #6391
Ref #5697

[netlify]

✅ Deploy Preview for inventree-web-pui-preview ready!

Name	Link
🔨 Latest commit	2b5867a
🔍 Latest deploy log	https://app.netlify.com/sites/inventree-web-pui-preview/deploys/660c4e119dc61a00085f0941
😎 Deploy Preview	https://deploy-preview-6399--inventree-web-pui-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 100 (no change from production) Accessibility: 86 (no change from production) Best Practices: 100 (no change from production) SEO: 70 (no change from production) PWA: - View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[SchrodingersGat]

netlify preview does not seem to want to login currently - is that expected?

[matmair]

Seems like the CRSF stuff only works on the same domain, have to look deeper into it

[SchrodingersGat]

Seems like the CRSF stuff only works on the same domain, have to look deeper into it

Have you set the INVENTREE_TRUSTED_ORIGINS setting? - https://docs.inventree.org/en/latest/start/config/#server-access

What errors / feedback are you getting here?

[matmair]

Seems to fix #5697 put I would like to see this confirmed after the demo server runs this version before closing that

[SchrodingersGat]

@matmair does not seem to work locally for me. I have pulled down the code, and running in a private browser session. Stuck at the "login" screen:

The "token" request is being made correctly, and returns:

• api token
• CSRF token
• session token

But none of these tokens get sent in the next request to /api/user/me/:

And so the server rejects it of course:

[SchrodingersGat]

@matmair it seems that this approach does not let the user upload files?

[matmair]

It seems to work localy but we would need to change CSRF to lax - not sure if it is worth it

[SchrodingersGat]

It seems to work localy but we would need to change CSRF to lax - not sure if it is worth it

Can you expand on this? What adjustments would we need to make to CSRF?

[matmair]

Replaced by #6970