From f0adfda52708d07147bcb72b387c82c91eadafd6 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 30 Nov 2021 13:41:37 +0100 Subject: [PATCH] api-docs: use hardcoded script sha for oauth2-redirect.html CSP Signed-off-by: Patrik Oldsberg --- plugins/api-docs/README.md | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/plugins/api-docs/README.md b/plugins/api-docs/README.md index be98304cfe..4919690568 100644 --- a/plugins/api-docs/README.md +++ b/plugins/api-docs/README.md @@ -160,17 +160,13 @@ by this plugin. Grab a copy of [oauth2-redirect.html](https://github.com/swagger-api/swagger-ui/blob/master/dist/oauth2-redirect.html) and put it in the `app/public/` directory in order to enable Swagger UI to complete this redirection. -This also may require you to adjust `Content Security Policy` header settings of your backstage application. So javascript on `oauth2-redirect.html` can be executed. +This also may require you to adjust `Content Security Policy` header settings of your Backstage application, so that the script in `oauth2-redirect.html` can be executed. Since the script is static we can add the hash of it directly to our CSP policy, which we do by adding the following to the `csp` section of the app configuration: -There are two steps: -1. Open `oauth2-redirect.html` for editing and add `nonce` to the `script` tag. Like this - ``` -