diff --git a/plugins/auth-backend/src/lib/OAuthProvider.ts b/plugins/auth-backend/src/lib/OAuthProvider.ts
index 923a79b72c..f2b8c8e09c 100644
--- a/plugins/auth-backend/src/lib/OAuthProvider.ts
+++ b/plugins/auth-backend/src/lib/OAuthProvider.ts
@@ -92,16 +92,19 @@ export const postMessageResponse = (
res.setHeader('Content-Type', 'text/html');
res.setHeader('X-Frame-Options', 'sameorigin');
- res.setHeader('Content-Security-Policy', "script-src 'unsafe-inline'");
// TODO: Make target app origin configurable globally
+ const script = `
+ (window.opener || window.parent).postMessage(JSON.parse(atob('${base64Data}')), '${appOrigin}')
+ window.close()
+ `;
+ const hash = crypto.createHash('sha256').update(script).digest('base64');
+ res.setHeader('Content-Security-Policy', `script-src 'sha256-${hash}'`);
+
res.end(`
-
+
`);