Add CSRF check in UsageData API

doc/development/telemetry/usage_ping.md

@@ -330,9 +330,10 @@ Implemented using Redis methods [PFADD](https://redis.io/commands/pfadd) and [PF
 
    Return 200 if tracking failed for any reason.
 
-   - `401 Unauthorized` if user is not authenticated
-   - `400 Bad request` if event parameter is missing
    - `200` if event was tracked or any errors
+   - `400 Bad request` if event parameter is missing
+   - `401 Unauthorized` if user is not authenticated
+   - `403 Forbidden` for invalid CSRF token provided
 
 1. Track event using base module `Gitlab::UsageDataCounters::HLLRedisCounter.track_event(entity_id, event_name)`.
 

lib/api/usage_data.rb

@@ -7,6 +7,7 @@ module API
     namespace 'usage_data' do
       before do
         not_found! unless Feature.enabled?(:usage_data_api)
+        forbidden!('Invalid CSRF token is provided') unless verified_request?
       end
 
       desc 'Track usage data events' do

spec/requests/api/usage_data_spec.rb

@@ -10,6 +10,17 @@ RSpec.describe API::UsageData do
     let(:known_event) { 'g_compliance_dashboard' }
     let(:unknown_event) { 'unknown' }
 
+    context 'without CSRF token' do
+      it 'returns forbidden' do
+        stub_feature_flags(usage_data_api: true)
+        allow(Gitlab::RequestForgeryProtection).to receive(:verified?).and_return(false)
+
+        post api(endpoint, user), params: { event: known_event }
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+
     context 'usage_data_api feature not enabled' do
       it 'returns not_found' do
         stub_feature_flags(usage_data_api: false)
@@ -33,6 +44,7 @@ RSpec.describe API::UsageData do
         stub_feature_flags(usage_data_api: true)
         stub_feature_flags("usage_data_#{known_event}" => true)
         stub_application_setting(usage_ping_enabled: true)
+        allow(Gitlab::RequestForgeryProtection).to receive(:verified?).and_return(true)
       end
 
       context 'when event is missing from params' do