auth backend: fix CSP by setting script hash

2020-08-06 22:28:06 +02:00
parent 032ba401af
commit 353af384da
1 changed files with 8 additions and 5 deletions
@@ -92,16 +92,19 @@ export const postMessageResponse = (

  res.setHeader('Content-Type', 'text/html');
  res.setHeader('X-Frame-Options', 'sameorigin');
-  res.setHeader('Content-Security-Policy', "script-src 'unsafe-inline'");

  // TODO: Make target app origin configurable globally
+  const script = `
+    (window.opener || window.parent).postMessage(JSON.parse(atob('${base64Data}')), '${appOrigin}')
+    window.close()
+  `;
+  const hash = crypto.createHash('sha256').update(script).digest('base64');
+  res.setHeader('Content-Security-Policy', `script-src 'sha256-${hash}'`);
+
  res.end(`
 <html>
 <body>
-  <script>
-    (window.opener || window.parent).postMessage(JSON.parse(atob('${base64Data}')), '${appOrigin}')
-    window.close()
-  </script>
+  <script>${script}</script>
 </body>
 </html>
  `);