Open all web links in Integrated Browser

[isc-bsaviano]

This PR adopts the new VS Code Integrated browser for all links that would previously be opened in an external browser. It does not log the user in using the CSPCHD query parameter for IRIS links since the Integrated Browser can store cookies.

integrated.browser.mov

[gjsjohnmurray]

@isc-bsaviano what do you see as the benefit of removing the CSPCHD mechanism?

[isc-bsaviano]

I'd rather let the browser handle it because the cookies will be shared amongst similar pages with no regard for how they were opened (this extension, server manager, or manual entry). Even though the links will be opened in a VS Code tab, I don't think users see these linked pages as "part of" VS Code and be upset at having to log in. They'd likely have to do it anyways even if we used the external browser. @isc-rsingh any thoughts?

[gjsjohnmurray]

In my testing, if an Integrated Browser tab first connects to an IRIS server with a URL that contains a CSPCHD queryparam (as still happens with my Server Manager PR intersystems-community/intersystems-servermanager#310), then subsequent Integrated Browser tabs using a URL to the same server but without a CSPCHD will still benefit from a session cookie, so won't prompt for credentials for this server in any VS Code window until all VS Code windows are closed (because the default data storage of Integrated Browser is Global, i.e. "workbench.browser.dataStorage": "global").

[isc-bsaviano]

Thanks for the comment John. I can put the CSPCHD mechanism back in, but it doesn't work for me. It's probably due to the default setting of "Always" for "Use Cookie for Session".

[isc-bsaviano]

@gjsjohnmurray @isc-rsingh I asked a principal dev on security team about CSPCHD. Here's what they said:

It is insecure to pass the session token in the URL This opens the application to session fixation an login CSRF attacks, as well as exposing the session id in URL logs.

By default the SMP and documatic do not support passing the session token in the URL, so that won't even work normally on recent versions.

Given this information, I don't support adding back CSPCHD. It's not a huge burden for users to enter credentials in the login page and we have a good reason for making them do so.

[gjsjohnmurray]

I approve the changes, including dropping CSPCHD support.