paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity

Merge pull request #1848 from spotify/rugvip/insecure-security-policy

Browse Source 
auth-backend: temporary fix for strict CSP being set
This commit is contained in:
Patrik Oldsberg
2020-08-06 16:52:39 +02:00
committed by GitHub
parent 8e9a815287 fcc0080af8
commit dd1c8d3f29
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/auth-backend/src/lib/OAuthProvider.test.ts
+2 -2
View File
@@ -125,7 +125,7 @@ describe('OAuthProvider Utils', () => {
const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
postMessageResponse(mockResponse, appOrigin, data);
expect(mockResponse.setHeader).toBeCalledTimes(2);
expect(mockResponse.setHeader).toBeCalledTimes(3);
expect(mockResponse.end).toBeCalledTimes(1);
expect(mockResponse.end).toBeCalledWith(
expect.stringContaining(base64Data),
@@ -146,7 +146,7 @@ describe('OAuthProvider Utils', () => {
const base64Data = Buffer.from(jsonData, 'utf8').toString('base64');
postMessageResponse(mockResponse, appOrigin, data);
expect(mockResponse.setHeader).toBeCalledTimes(2);
expect(mockResponse.setHeader).toBeCalledTimes(3);
expect(mockResponse.end).toBeCalledTimes(1);
expect(mockResponse.end).toBeCalledWith(
expect.stringContaining(base64Data),
plugins/auth-backend/src/lib/OAuthProvider.ts
+1
View File
@@ -64,6 +64,7 @@ export const postMessageResponse = (
res.setHeader('Content-Type', 'text/html');
res.setHeader('X-Frame-Options', 'sameorigin');
res.setHeader('Content-Security-Policy', "script-src 'unsafe-inline'");
// TODO: Make target app origin configurable globally
res.end(`