[java-identity-provider] branch dev/thymeleaf updated: Working CSP example.

Fri Feb 2 18:46:10 UTC 2024

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch dev/thymeleaf
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d1e878f4c761970fc5d3c7b2b73082499271b368

The following commit(s) were added to refs/heads/dev/thymeleaf by this push:
     new d1e878f4c Working CSP example.
d1e878f4c is described below

commit d1e878f4c761970fc5d3c7b2b73082499271b368
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Feb 2 13:46:07 2024 -0500

    Working CSP example.
---
 .../net/shibboleth/idp/module/views/login.html     | 33 ++++++++++++++++++----
 1 file changed, 27 insertions(+), 6 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/login.html b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/login.html
index 3732b66fe..91d9ca3d8 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/login.html
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/login.html
@@ -20,10 +20,6 @@ response - HttpServletResponse
 environment - Spring Environment object for property resolution
 custom - arbitrary object injected by deployer
 username - username associated with the current authentication event
-
-Following velocity variables are TBD
-#set ($onClick = "this.childNodes[0].nodeValue='#springMessageText('idp.login.pleasewait', 'Logging in, please wait...')'")
-#$response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onClick)'")
 */-->
 <!DOCTYPE html>
 <html>
@@ -101,9 +97,13 @@ Following velocity variables are TBD
                     </label>
                     <div class="grid">
                         <div class="grid-item">
-                            <button type="submit"
+                            <button data-th-with="onClick='loginOnClick(this)',
+                                        digest=${cspDigester.apply(onClick)},
+                                        cspValue=|script-src-attr 'unsafe-hashes' 'sha256-${digest}'|,
+                                        csp=${response.addHeader('Content-Security-Policy', cspValue)}"
+                                    type="submit"
                                     name="_eventId_proceed"
-                                    data-th-onclick="${onClick}"
+                                    onclick="loginOnClick(this)"
                                     data-th-text="#{idp.login.login}">
                                 Login
                             </button>
@@ -134,5 +134,26 @@ Following velocity variables are TBD
                 <p data-th-text="#{idp.footer}">Insert your footer text here.</p>
             </div>
         </footer>
+
+        <script data-th-with="nonce=${cspNonce.generateIdentifier()},
+                cspValue=|script-src-elem 'nonce-${nonce}'|,
+                csp=${response.addHeader('Content-Security-Policy', cspValue)}"
+            data-th-nonce="${nonce}"
+            data-th-inline="javascript">
+        <!--
+        function loginOnClick(button) {
+        	button.childNodes[0].nodeValue = /*[[#{idp.login.pleasewait}]]*/ "Logging in, please wait...";
+        }
+        
+        const ufield = document.getElementById('username');
+        const pfield = document.getElementById('password');
+        if (ufield.value.trim().length == 0) {
+            ufield.focus();
+        } else {
+            pfield.focus();
+        }
+        // -->
+        </script>
+        
      </body>
 </html>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
