search

IdentityPython / djangosaml2

Django SAML2 Service Provider based on pySAML2
Apache License 2.0
258 stars 143 forks source link

Fix Content-Security-Policy if hash is included in script-src #404

Closed prauscher closed 5 months ago

prauscher commented 5 months ago

See #403 for the problem. This PR addresses option 2, so a default post-binding-template is specified which includes a nonce. We also bump the version on request of @peppelinux

prauscher commented 5 months ago

Just realized that Logout would have a similar problem, so i'll probably add another template

peppelinux commented 5 months ago

Just realized that Logout would have a similar problem, so i'll probably add another template

Please create a base template that should be inherited by login and logout sub templates

prauscher commented 5 months ago

I looked into it found that djangosaml2 currently takes its html for logout with post binding directly from pysaml2. Changing this would require quite some changes in djangosaml2 which are probably not worth the efford for now. My suggestion would be to create a new issue to document the problem and merge this PR - do you agree, @peppelinux ?

tinyx commented 2 months ago

This is minor, but I would like to point out that the PySAML template had all the visible elements wrapped with a <noscript> so the user will not notice anything but a blank page.

With this change though, they will see the un-styled text and button, which again, is minor, but could be a surprise from a patch update.