Opensaml 2 Java: Content Security Policy not working with HTTP Post Binding Template

[Ludewig, Georg]

Dear ,

I hope this is the right mailing list to post to.  We are using opensaml in our application using HTTP Post Binding. The HTTP Post Binding Template (opensaml.jar -> templates\saml2-post-binding.vm) uses inline javascript (onload attribute on body). Due to this, we cannot enable the following CSP Header on our Server:

            Content-Security-Policy: default-src 'self';

If this header is set, the Form won't be submitted, since the browser is preventing it. Any advise how to handle this. Shouldn't the template be updated to work with this CSP?

Note: we can't use redirect binding

Thx,

Georg Ludewig


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150610/524c5be2/attachment.html>