[java-idp-oidc] branch main updated: JOIDC-179 - Add CSP protection to views

Fri Mar 15 13:37:25 UTC 2024

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-idp-oidc.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-oidc.git;a=commit;h=343303a98f33d9d0e5f892aa675352fb17da5180

The following commit(s) were added to refs/heads/main by this push:
     new 343303a9 JOIDC-179 - Add CSP protection to views
343303a9 is described below

commit 343303a98f33d9d0e5f892aa675352fb17da5180
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 15 15:36:50 2024 +0200

    JOIDC-179 - Add CSP protection to views
    
    https://shibboleth.atlassian.net/browse/JOIDC-179
    
    - Add policy to oidc-front-iframe.vm
---
 .../META-INF/net/shibboleth/idp/views/logout/oidc-front-iframe.vm      | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/views/logout/oidc-front-iframe.vm b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/views/logout/oidc-front-iframe.vm
index 31af34b4..8bbec580 100644
--- a/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/views/logout/oidc-front-iframe.vm
+++ b/idp-oidc-extension-impl/src/main/resources/META-INF/net/shibboleth/idp/views/logout/oidc-front-iframe.vm
@@ -1,3 +1,4 @@
+$response.addHeader("Content-Security-Policy", "script-src 'none'")
 <html>
   <head>
     <meta http-equiv = "refresh" content = "0; url = $flowExecutionUrl&_eventId_proceed=1" />
@@ -5,4 +6,4 @@
   <body>
     <iframe src="$frontChannelLogoutLocation" style="display:none"></iframe>
   </body>
-</html>
\ No newline at end of file
+</html>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
