5

I'm building a SPA using oidc-client to sign in to an IDP built using Identity Server 4.

The login redirections seems to work fine but on Firefox I'm getting the following CSP issues

enter image description here

Content Security Policy: Ignoring "'unsafe-inline'" within script-src or style-src: nonce-source or hash-source specified  (unknown)
Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src 'unsafe-inline' 'sha256-VDXN0nOpFPQ102CIVz+eimHA5e+wTeoUUQj5ZYbtn8w='"). Source: !function(t){function __webpack_require_....  checksession:1
Content Security Policy: The page's settings blocked the loading of a resource at self ("script-src 'unsafe-inline' 'sha256-VDXN0nOpFPQ102CIVz+eimHA5e+wTeoUUQj5ZYbtn8w='"). Source: window.devToolsOptions = Object.assign(w....  checksession:1
Load denied by X-Frame-Options: http://localhost:5007/home/error?errorId=a74accc61bb821ee1f42f7013a306e90 does not permit cross-origin framing.  (unknown)

I'm not setting any CSP meta tags on my SPA and I'm wondering if I have to. Digging a little bit it seems that oidc-client is adding an iframe into my application which points to the checksession page in Identity Server (which does include the CSP header "default-src 'none'; script-src 'unsafe-inline' 'sha256-VDXN0nOpFPQ102CIVz+eimHA5e+wTeoUUQj5ZYbtn8w='")

Can someone help me solving this or lead me into the right direction? My knowledge about CSP is very basic.

curial
  • 514
  • 4
  • 17
  • I happen to be diagnosing the exact same issue at the moment. We are experiencing the behavior in chrome. I just updated IDSrvr4. Could be related to https://github.com/IdentityServer/IdentityServer4/issues/659. And or this.. https://stackoverflow.com/questions/41854600/identityserver-used-as-external-identity-provider-for-another-identityserver-fai/41862927#answer-41862927 – ttugates Jun 20 '17 at 15:42
  • Are you also experiencing "Frame window timed out" in signinSilent when app is closed while toke expires? https://github.com/IdentityModel/oidc-client-js/issues/311 – ttugates Jun 20 '17 at 16:04
  • Opended this here.. https://github.com/IdentityModel/oidc-client-js/issues/357 – ttugates Jun 20 '17 at 16:12

1 Answers1

1

It was the Redux devtools addon trying to inject their code on the page.

curial
  • 514
  • 4
  • 17