Firefox 108 issues with IDP 4.x w/ strict CSP

Wed Dec 21 05:39:42 UTC 2022

Has anyone tried the latest Firefox release 108.0.1 with IDP 4?   If
you have strict CSP in place the POST to
idp/profile/SAML2/Redirect/SSO is blocked because of the following CSP
violation.

Content Security Policy: The page’s settings blocked the loading of a
resource at inline (“script-src”). Source: document.forms[0].submit().

It seems to be related to the following security fix in the Firefox
108.0.1 release...

https://bugzilla.mozilla.org/show_bug.cgi?id=1644790

The code that is now being blocked is <body
onload="document.forms[0].submit()"> on the following page. I haven't
figured out which template that's coming from yet.   I tried adding a
csp hash for it, but that didn't fix the issue.

<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8" />
            </head>
    <body onload="document.forms[0].submit()">
        <noscript>
            <p>
                <strong>Note:</strong> Since your browser does not
support JavaScript,
                you must press the Continue button once to proceed.
            </p>
        </noscript>

        <form action="https&#x3a;&#x2f;&#x2f;myhost&#x2f;Shibboleth.sso&#x2f;SAML2&#x2f;POST"
method="post">
            <div>
                <input type="hidden" name="RelayState" value=""/>

                <input type="hidden" name="SAMLResponse" value=
            </div>
            <noscript>
                <div>
                    <input type="submit" value="Continue"/>
                </div>
            </noscript>
        </form>
            </body>
</html>

--

Thanks,

Dan