Firefox 108 issues with IDP 4.x w/ strict CSP

[Dan McLaughlin]

Can you think of a reason why IDP 5 would work, and IDP 4 doesn't?  In
the POST to the IDP that is failing to load on IDP 4 I can see the
onload in the response, but in IDP 5 devtools doesn't show the
response so I couldn't tell if it was there.  I'll try using
CharlesProxy and see if I can see the response on IDP 5. You know
better than me, so I'm assuming it's there and I just can't see it.
I'm thinking it might be that Firefox behaves differently if CSRF is
enabled and that's why IDP 5 works.  We do have CSRF enabled and
implemented on our custom login page on IDP 5, and we aren't using
CSRF on IDP 4.

--

Thanks,

Dan

On Wed, Dec 21, 2022 at 9:11 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> > IDP 5 works, IDP 4 doesn't. The page that is failing to load doesn't
> > seem to be in IDP 5, at least not that I've found.
>
> Same place, the default binding views are in opensaml-saml-impl.jar in /templates/
>
> -- Scott
>
>