search

WeblateOrg / weblate

Web based localization tool with tight version control integration.
https://weblate.org/
GNU General Public License v3.0
4.49k stars 993 forks source link

Automatic configuration of Content Security Policy form-action for Social Auth #12321

Closed michael-smt closed 2 weeks ago

michael-smt commented 2 weeks ago

Describe the problem

The stricter Content Security Policy since Weblate 5.7 requires careful configuration of the CSP_FORM_SRC when using social authentication providers, because some browsers block redirects after a form submission.

Describe the solution you would like

It would be nice if enabling a social auth provider would also automatically set the appropriate form-action Content Security Policy header values.

For example when WEBLATE_SOCIAL_AUTH_AUTH0_DOMAIN is configured it could be automatically added to WEBLATE_CSP_FORM_SRC.

Describe alternatives you have considered

Describe the required setting of CSP_FORM_SRC in the social provider documentation based on the experience from hosted.weblate.org.

Screenshots

No response

Additional context

Depending on the provider (Auth0, possibly also others) there might be additional redirects to other authentication providers, these could not be automatically configured.

nijel commented 2 weeks ago

The intention was to handle that automatically, but the code doesn't cover all the cases:

https://github.com/WeblateOrg/weblate/blob/9259f38c138ac0e78f961a90d2b5e817d6306a53/weblate/middleware.py#L336-L347

PS: There is also https://github.com/WeblateOrg/weblate/issues/12302

PS2: I think in both cases it would be addressed by using authorization_url() method instead of AUTHORIZATION_URL atribute.

github-actions[bot] commented 2 weeks ago

Thank you for your report; the issue you have reported has just been fixed.

github-actions[bot] commented 2 weeks ago

Thank you for your report; the issue you have reported has just been fixed.