Content-Security-Policy and X-Frame-Options header config in idp.properties

[Losen, Stephen C (scl)]

Hi folks,

Found out some folks here are displaying Shib IDP pages inside iFrames and that no longer works for them (IDP 3.4.2)

I see this in idp.properties (as distributed)

# HSTS/CSP response headers
#idp.hsts = max-age=0
# X-Frame-Options value, set to DENY or SAMEORIGIN to block framing
#idp.frameoptions = DENY
# Content-Security-Policy value, set to match X-Frame-Options default
#idp.csp = frame-ancestors 'none';

Did a little research and changed to this:

# HSTS/CSP response headers
#idp.hsts = max-age=0
# X-Frame-Options value, set to DENY or SAMEORIGIN to block framing
#idp.frameoptions = DENY
idp.frameoptions = allow-from https://collab.its.virginia.edu/
# Content-Security-Policy value, set to match X-Frame-Options default
#idp.csp = frame-ancestors 'none';
idp.csp = frame-ancestors *.virginia.edu;

However that didn't help. Put the browser into "Developer" mode and looked at the IDP response headers and I see this:

Content-Security-Policy: frame-ancestors 'none';
Content-Security-Policy: frame-ancestors *.virginia.edu;
X-Frame-Options: DENY
X-Frame-Options: allow-from https://collab.its.virginia.edu/

This is sorted order, not the actual order. The two default headers come first as if they are generated unconditionally. Then come some more headers, and then the headers from idp.properties

Is this an IDP bug? Or do I misunderstand how this works? I don't suppose this can be handled in the velocity template.

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640