Content-Security-Policy and X-Frame-Options header config in http://antispam.csu.edu.au:32224/?dmVyPTEuMDAxJiY0YzA0ZThiMjA1NmJhYTkyNT01QzM3QjFEOV81NzM5OF84Nzk1XzEmJmZiNjI0N2U4ODdhYTNmZD0xMzMzJiZ1cmw9aWRwJTJFcHJvcGVydGllcw==

[Lipscomb, Gary]

We had the same issue and had to set the values to null

# HSTS/CSP response headers
#idp.hsts = max-age=0
# X-Frame-Options value, set to DENY or SAMEORIGIN to block framing
#idp.frameoptions = DENY
idp.frameoptions =
# Content-Security-Policy value, set to match X-Frame-Options default
#idp.csp = frame-ancestors 'none';
idp.csp =

This was to work around issues with our Blackboard Learn application

Regards

Gary

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, 11 January 2019 07:58
To: Shib Users <users at shibboleth.net>
Subject: Re: Content-Security-Policy and X-Frame-Options header config in http://antispam.csu.edu.au:32224/?dmVyPTEuMDAxJiY0YzA0ZThiMjA1NmJhYTkyNT01QzM3QjFEOV81NzM5OF84Nzk1XzEmJmZiNjI0N2U4ODdhYTNmZD0xMzMzJiZ1cmw9aWRwJTJFcHJvcGVydGllcw==

On 1/10/19, 3:31 PM, "users on behalf of Losen, Stephen C (scl)" <users-bounces at shibboleth.net on behalf of scl at virginia.edu> wrote:

> Found out some folks here are displaying Shib IDP pages inside iFrames and that no longer works for them (IDP 3.4.2)

It's not supported regardless, I want that to be clear. We have never supported their use, dating back to V1. Adding the headers was an add-on to highlight that fact. All your users with third party cookies off are already being locked out whether you include the header or not.

> Is this an IDP bug? Or do I misunderstand how this works?

I've changed them in the past, I haven't seen anything like that. Just tested it.
 
-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net