search

gbv / login-server

Login and connect accounts with multiple identity providers
https://coli-conc.gbv.de/login/
MIT License
31 stars 32 forks source link

Can we adjust Cross-Origin-Opener-Policy? #88

Closed stefandesu closed 2 years ago

stefandesu commented 2 years ago

I have found out that, probably due to an update to the Helmet library that we're using for security headers, we can't close the Login Server window from Cocoda even though we opened it through Cocoda (https://github.com/gbv/cocoda/issues/662).

Changing the Cross-Origin-Opener-Policy header to unsafe-none fixes the issue, but right now I'm not sure if there are any repercussions from this change. To improve the login flow in Cocoda, it would be nice to get the window closing back.

stefandesu commented 2 years ago

I found out if both client (i.e. the web server that hosts Cocoda) and server (Login Server) have the header set to same-origin-allow-popups, it works as well. 👍

stefandesu commented 2 years ago

To make it work during local development (where Cocoda and Login Server use different origins), I've made the header value dependent on config.ssl.