From 353af384da40427de160d08824d78a099b3391e2 Mon Sep 17 00:00:00 2001 From: Ljupcho Kotev Date: Thu, 6 Aug 2020 22:28:06 +0200 Subject: [PATCH] auth backend: fix CSP by setting script hash --- plugins/auth-backend/src/lib/OAuthProvider.ts | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/plugins/auth-backend/src/lib/OAuthProvider.ts b/plugins/auth-backend/src/lib/OAuthProvider.ts index 923a79b72c..f2b8c8e09c 100644 --- a/plugins/auth-backend/src/lib/OAuthProvider.ts +++ b/plugins/auth-backend/src/lib/OAuthProvider.ts @@ -92,16 +92,19 @@ export const postMessageResponse = ( res.setHeader('Content-Type', 'text/html'); res.setHeader('X-Frame-Options', 'sameorigin'); - res.setHeader('Content-Security-Policy', "script-src 'unsafe-inline'"); // TODO: Make target app origin configurable globally + const script = ` + (window.opener || window.parent).postMessage(JSON.parse(atob('${base64Data}')), '${appOrigin}') + window.close() + `; + const hash = crypto.createHash('sha256').update(script).digest('base64'); + res.setHeader('Content-Security-Policy', `script-src 'sha256-${hash}'`); + res.end(` - + `);