Content Security Policy blocking script

Tue Sep 24 05:02:02 UTC 2024

IdP 5.1.3

Hi List,

We currently had this as a footer in 4.3.3 to get the current year.

Copyright © 2016-<l id="CSU_year"></l> <script nonce="$nonce">const d = new Date(); let year = d.getFullYear(); document.getElementById("CSU_year").innerHTML = year; </script> Charles Sturt University. TEQSA Provider Identification: PRV12018 (Australian University). CRICOS Provider: 00005F.

which is now blocked as explained here
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510790/UserInterface#Content-Security-Policy

I've added the #set nonce and response header as shown below

#else
        ## This is a catch-all that theoretically shouldn't happen?
    #set ($titleSuffix = $defaultTitleSuffix)
    #set ($message = $springMacroRequestContext.getMessage("idp.message", "An unidentified error occurred."))
    $response.setStatus(500)
#end

#set ($nonce = $cspNonce.generateIdentifier())       <<<<<<  added

##
$response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")      <<<<<< added

<!DOCTYPE html>
<html>
    <head>

 to error.vm but I see this error in the console when accessing the error page and the year is not added.

Content-Security-Policy: The page’s settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: “script-src-elem 'nonce-_af31742669914fc1602b3a6cbf045f16'”

            <div class="cc">
                <p>Copyright © 2016-<l id="CSU_year"></l> <script nonce="$nonce">const d = new Date(); let year = d.getFullYear(); document.getElementById("CSU_year").innerHTML = year; </script> Charles Sturt University. TEQSA Provider Identification: PRV12018 (Australian University). CRICOS Provider: 00005F.</p>
            </div>

I've missed something but not sure what?
Any pointers?
regards
Gary

Gary Lipscomb

Technical Officer, Systems

IT Infrastructure & Security | Division of Information Technology

Charles Sturt University, Bathurst, NSW 2795

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240924/8bbf87ab/attachment.htm>