search

andrewlock / NetEscapades.AspNetCore.SecurityHeaders

Small package to allow adding security headers to ASP.NET Core websites
MIT License
695 stars 72 forks source link

OIDC error #135

Closed daver77 closed 1 year ago

daver77 commented 1 year ago

We've noticed lots of OIDC errors on our websites since adding stricter CSP headers

image

At first I thought how can NetEscapades have anything to do with this, then I found this post suggesting that too many CSP's can cause issues https://stackoverflow.com/questions/73560959/getting-502-bad-gateway-in-post-applicatonurl-signin-oidc-after-apply-nwebsec-c

Has anyone else come across this issue?

andrewlock commented 1 year ago

This immediately made me think of this: https://andrewlock.net/fixing-nginx-upstream-sent-too-big-header-error-when-running-an-ingress-controller-in-kubernetes/

Basically, having headers that are too big can be a problem. Unfortunately, there's not a one-size-fits-all solution.

Afaik, the best option may be to try to consolidate some of your CSP directives. For example, instead of setting both script-src and style-erc, just use default-src instead; things like that.

Not great, I know, but other options to increase buffers etc may end up giving you issues down the line, so my first go-to would be to do this.

If that's not possible, looking into increasing buffer/header sizes may work. Either way I don't think there's anything the library can do to solve this 🤔

daver77 commented 1 year ago

Yeah, the strange thing is that the errors are random, sometimes it works, sometimes not. It shows it happening on /signin-oidc so I presume some OpenID responses are sending it over the limit.

I'll look into reducing the CSP.

daver77 commented 1 year ago

Just in case anyone come across this, the issue was end-user error, nothing to do with code or CSP