From fb7a0bdeac53d15c02e472e3eaebeb9b16c2aad3 Mon Sep 17 00:00:00 2001
From: Pavel <me@pavelpolyakov.com>
Date: Thu, 28 Oct 2021 10:48:51 +0200
Subject: [PATCH 1/2] Update README.md

This is needed, otherwise, after you're redirected back there is an error from browser and nothing works.

Signed-off-by: Pavlo Poliakov <pavlo.poliakov@share-now.com>
---
 plugins/api-docs/README.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/plugins/api-docs/README.md b/plugins/api-docs/README.md
index d5ed198dc1..be98304cfe 100644
--- a/plugins/api-docs/README.md
+++ b/plugins/api-docs/README.md
@@ -160,6 +160,18 @@ by this plugin.
 Grab a copy of [oauth2-redirect.html](https://github.com/swagger-api/swagger-ui/blob/master/dist/oauth2-redirect.html)
 and put it in the `app/public/` directory in order to enable Swagger UI to complete this redirection.
 
+This also may require you to adjust `Content Security Policy` header settings of your backstage application. So javascript on `oauth2-redirect.html` can be executed.
+
+There are two steps:
+1. Open `oauth2-redirect.html` for editing and add `nonce` to the `script` tag. Like this
+  ```
+  <script nonce="oauth2-redirect">
+  ```
+2. Now adjust backstage configuration, `backend.csp` section and add there new property:
+  ```
+  script-src: ["'self'", "'nonce-oauth2-redirect'", "'unsafe-eval'"]
+  ```
+
 #### Configuring your OAuth2 Client
 
 You'll need to make sure your OAuth2 client has been registered in your OAuth2 Authentication Server (AS)

From f0adfda52708d07147bcb72b387c82c91eadafd6 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Tue, 30 Nov 2021 13:41:37 +0100
Subject: [PATCH 2/2] api-docs: use hardcoded script sha for
 oauth2-redirect.html CSP

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 plugins/api-docs/README.md | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/plugins/api-docs/README.md b/plugins/api-docs/README.md
index be98304cfe..4919690568 100644
--- a/plugins/api-docs/README.md
+++ b/plugins/api-docs/README.md
@@ -160,17 +160,13 @@ by this plugin.
 Grab a copy of [oauth2-redirect.html](https://github.com/swagger-api/swagger-ui/blob/master/dist/oauth2-redirect.html)
 and put it in the `app/public/` directory in order to enable Swagger UI to complete this redirection.
 
-This also may require you to adjust `Content Security Policy` header settings of your backstage application. So javascript on `oauth2-redirect.html` can be executed.
+This also may require you to adjust `Content Security Policy` header settings of your Backstage application, so that the script in `oauth2-redirect.html` can be executed. Since the script is static we can add the hash of it directly to our CSP policy, which we do by adding the following to the `csp` section of the app configuration:
 
-There are two steps:
-1. Open `oauth2-redirect.html` for editing and add `nonce` to the `script` tag. Like this
-  ```
-  <script nonce="oauth2-redirect">
-  ```
-2. Now adjust backstage configuration, `backend.csp` section and add there new property:
-  ```
-  script-src: ["'self'", "'nonce-oauth2-redirect'", "'unsafe-eval'"]
-  ```
+```yaml
+script-src:
+  - "'self'"
+  - "'sha256-GeDavzSZ8O71Jggf/pQkKbt52dfZkrdNMQ3e+Ox+AkI='" # oauth2-redirect.html
+```
 
 #### Configuring your OAuth2 Client