Opensaml 2 Java: Content Security Policy not working with HTTP Post Binding Template

[Ludewig, Georg]

thx scott for quick response. overriding might be a proper workaround, haven't thought of that!

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Mittwoch, 10. Juni 2015 16:22
To: Shib Users
Subject: Re: Opensaml 2 Java: Content Security Policy not working with HTTP Post Binding Template

On 6/10/15, 2:07 PM, "Ludewig, Georg" <Georg.Ludewig at ch.unisys.com> wrote:



>Dear ,
> 
>I hope this is the right mailing list to post to.

It's not, the dev list is where OpenSAML questions need to go. Please send 
any follow ups there.

>We are using opensaml in our application using HTTP Post Binding. The 
>HTTP Post Binding Template (opensaml.jar -> 
>templates\saml2-post-binding.vm) uses inline
> javascript (onload attribute on body). Due to this, we cannot enable the 
>following CSP Header on our Server:
> 
>            Content-Security-Policy: default-src 'self';
> 
>If this header is set, the Form won’t be submitted, since the browser is 
>preventing it. Any advise how to handle this. Shouldn’t the template be 
>updated to work with this CSP?

I have no idea what any of that means, but the template can be overriden 
on the classpath so you can make it whatever you want it to be already.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net