Empty body responses can violate content security policy
#4,652 opened on May 29, 2018
Repository metrics
- Stars
- (37,933 stars)
- PR merge metrics
- (Avg merge 16d 9h) (258 merged PRs in 30d)
Description
Overview
I have a basic MVC website utilizing OIDC with authorization code flow for authentication. After implementing a content security policy, remote sign out will no longer function.
On remote signout the OpenIdConnectHandler will respond with a response of code 200 but with no body. As a result, browsers will interpret the response by improvising the text/html content. This can result in a content security policy violation based on the browser's improvisation.
Reproduction
I have a repository with the most basic configuration.
Using Chrome, navigate directly to the RemoteSignOutPath (/signout-oidc)
Chrome will report a content security policy violation from the pre element's inline style:
<html>
<head></head>
<body>
<pre style="word-wrap: break-word; white-space: pre-wrap;"></pre>
</body>
</html>
Currently there is limited recourse. I understand I have several options: using 'unsafe-inline', overriding the remote sign out implementation via the OnRemoteSignOut event, or add middleware to change the content security policy for the RemoteSignOutPath specifically. These options are somewhat contrived and not what I would think ideal. However, if there is a better solution that I am overlooking I would appreciate any insight.
I would request consideration for the text/html status code 200 HTTP responses include a body to avoid this browser improvisation.