<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:13.0pt">Dear ,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt">I hope this is the right mailing list to post to. We are using opensaml in our application using HTTP Post Binding. The HTTP Post Binding Template (opensaml.jar -> templates\saml2-post-binding.vm) uses inline
javascript (onload attribute on body). Due to this, we cannot enable the following CSP Header on our Server:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt"> Content-Security-Policy: default-src 'self';<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:13.0pt">If this header is set, the Form won’t be submitted, since the browser is preventing it. Any advise how to handle this. Shouldn’t the template be updated to work with this CSP?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt">Note: we can’t use redirect binding<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt">Thx,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt">Georg Ludewig<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:13.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>