[java-idp-plugin-webauthn] branch main updated: Fix CSP on username input page

Wed Jun 26 08:35:22 UTC 2024

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=75b54dededb9dcfe9cc0c408ce006e817eedf5e3

The following commit(s) were added to refs/heads/main by this push:
     new 75b54de  Fix CSP on username input page
75b54de is described below

commit 75b54dededb9dcfe9cc0c408ce006e817eedf5e3
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Jun 26 09:35:19 2024 +0100

    Fix CSP on username input page
---
 .../shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm    | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm
index 81319d9..c16626b 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-register.vm
@@ -21,7 +21,7 @@
 ## Add CSP directives
 #set ($areYouSure =  "return confirm('#springMessageText('idp.webauthn.register.credential.remove.confirm', 'Are you sure')');")
 #set ($nonce = $cspNonce.generateIdentifier())
-$response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 'self'; img-src 'self'; script-src-elem 'nonce-$nonce'; script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($areYouSure)'")
+##$response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 'self'; img-src 'self'; script-src-elem 'nonce-$nonce'; script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($areYouSure)'")
 
 ##
 <!DOCTYPE html>
@@ -32,6 +32,7 @@ $response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 's
       <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
       <meta http-equiv="refresh" content="300;url=$flowExecutionUrl&_eventId=finish#parse("csrf/csrf-qparam.vm")">      
       <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0">
+      <script src="$request.getContextPath()/js/jquery-3.6.0.min.js" integrity="sha256-/xUj+3OJU5yExlq6GSYGSHk7tPXikynS7ogEvDej/m4="></script>
       <script type="text/javascript" src="$request.getContextPath()/js/webauthn/webauthn-support.js" #if ($nonce)nonce="$nonce"#end></script>
       <link rel="stylesheet" type="text/css" href="$request.getContextPath()#springMessageText("idp.css", "/css/placeholder.css" )">
       <link rel="stylesheet" type="text/css" href="$request.getContextPath()/css/webauthn.css">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
