倉庫指標
- Star
- (37,933 star)
- PR 合併指標
- (平均合併 16天 9小時) (30 天內合併 258 個 PR)
描述
Overview
I have a basic MVC website utilizing OIDC with authorization code flow for authentication. After implementing a content security policy, remote sign out will no longer function.
On remote signout the OpenIdConnectHandler will respond with a response of code 200 but with no body. As a result, browsers will interpret the response by improvising the text/html content. This can result in a content security policy violation based on the browser's improvisation.
Reproduction
I have a repository with the most basic configuration.
Using Chrome, navigate directly to the RemoteSignOutPath (/signout-oidc)
Chrome will report a content security policy violation from the pre element's inline style:
<html>
<head></head>
<body>
<pre style="word-wrap: break-word; white-space: pre-wrap;"></pre>
</body>
</html>
Currently there is limited recourse. I understand I have several options: using 'unsafe-inline', overriding the remote sign out implementation via the OnRemoteSignOut event, or add middleware to change the content security policy for the RemoteSignOutPath specifically. These options are somewhat contrived and not what I would think ideal. However, if there is a better solution that I am overlooking I would appreciate any insight.
I would request consideration for the text/html status code 200 HTTP responses include a body to avoid this browser improvisation.