Content-Security-Policy and X-Frame-Options header config in http://antispam.csu.edu.au:32224/?dmVyPTEuMDAxJiY0YzA0ZThiMjA1NmJhYTkyNT01QzM3QjFEOV81NzM5OF84Nzk1XzEmJmZiNjI0N2U4ODdhYTNmZD0xMzMzJiZ1cmw9aWRwJTJFcHJvcGVydGllcw==

[Losen, Stephen C (scl)]

In browser "developer" mode I definitely saw two X-Frame-Options headers and two Content-Security-Policy headers coming from the IDP, so I guess "last header wins?"

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, January 10, 2019 5:19 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Content-Security-Policy and X-Frame-Options header config in http://antispam.csu.edu.au:32224/?dmVyPTEuMDAxJiY0YzA0ZThiMjA1NmJhYTkyNT01QzM3QjFEOV81NzM5OF84Nzk1XzEmJmZiNjI0N2U4ODdhYTNmZD0xMzMzJiZ1cmw9aWRwJTJFcHJvcGVydGllcw==

On 1/10/19, 5:01 PM, "users on behalf of Lipscomb, Gary" <users-bounces at shibboleth.net on behalf of glipscomb at csu.edu.au> wrote:

> We had the same issue and had to set the values to null

That would be required to remove them outright, yes, that's how you explicitly "unset" the default value. Setting them to something else works as intended though.

It is somewhat awkward and I probably shouldn't have done it that way. If it changes, it would change in a more functional direction (by altering what "say nothing" means) and would be easy enough to highlight when the time comes.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net