Opensaml 2 Java: Content Security Policy not working with HTTP Post Binding Template

[Cantor, Scott]

On 6/10/15, 2:07 PM, "Ludewig, Georg" <Georg.Ludewig at ch.unisys.com> wrote:



>Dear ,
> 
>I hope this is the right mailing list to post to.

It's not, the dev list is where OpenSAML questions need to go. Please send 
any follow ups there.

>We are using opensaml in our application using HTTP Post Binding. The 
>HTTP Post Binding Template (opensaml.jar -> 
>templates\saml2-post-binding.vm) uses inline
> javascript (onload attribute on body). Due to this, we cannot enable the 
>following CSP Header on our Server:
> 
>            Content-Security-Policy: default-src 'self';
> 
>If this header is set, the Form won’t be submitted, since the browser is 
>preventing it. Any advise how to handle this. Shouldn’t the template be 
>updated to work with this CSP?

I have no idea what any of that means, but the template can be overriden 
on the classpath so you can make it whatever you want it to be already.

-- Scott