search

IdentityServer / IdentityServer3

OpenID Connect Provider and OAuth 2.0 Authorization Server Framework for ASP.NET 4.x/Katana
https://identityserver.github.io/Documentation/
Apache License 2.0
2.01k stars 763 forks source link

Allow adding to the CSP list #262

Closed brockallen closed 10 years ago

brockallen commented 10 years ago

To allow for custom views to embed external CSS/JS

ghost commented 10 years ago

+1 It would also be helpful to have an option to completely disable the CSP (e.g. to control SecurityHeadersAttribute.EnableCsp property from the identity server options).

Sometimes it is much easier to disable this when integrating with an existing infrastructure which uses inline scripts and various external JS.

brockallen commented 10 years ago

Added a CspOptions property on the idvsr configuration. You can enable/disable it, enable/disable the report endpoint and also add additional script-src and/or style-src values.

brockallen commented 10 years ago

Also updated the wiki with docs.

brockallen commented 9 years ago

FontSrc also added

sherland commented 9 years ago

Is there a similar way to disable Xfo? At https://github.com/IdentityServer/Thinktecture.IdentityServer3/blob/master/source/Core/Configuration/Hosting/SecurityHeadersAttribute.cs I see that EnableCsp reads the IdentityServerOptions, but it does not seem possible to change EnableXfo in a similar way.

leastprivilege commented 9 years ago

Why would you want to do that?

sherland commented 9 years ago

We have a SPA which shows the login-window in an iframe. When using auth0 as idp it's working, but when using IdentityServer we get a message similar to: [Refused to display 'url-to-idp' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN']

leastprivilege commented 9 years ago

Right - because we think that there is a security concern embedding the login screen into an untrusted page.

sherland commented 9 years ago

I definitely understand that you want to keep the default as safe as possible, but shouldn’t this be up to the user (operations)?

Naigel56 commented 8 years ago

Now it seems to work with the latest version (2.2.3 by now), so no need to download the whole IdentityServer 3 code and recompile it with this single change in SecurityHeadersAttribute.cs file

EnableXfo = false;

... as I have done previously with 2.1.1 version. Glad you removed the X-Frame-Options block!

brockallen commented 8 years ago

@firez5566 what do you mean by "Glad you removed the X-Frame-Options block"?