sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(auth): relax CSP script-src for auto-login page (inline JS was silently blocked)

Browse Source
This commit is contained in:
Krystie
2026-07-24 05:14:59 -07:00
parent ba21dad550
commit e208e05b83
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/routes/auth/sso-gate.js
+8
View File
@@ -209,6 +209,14 @@ module.exports = function(deps) {
if (!html) return res.status(404).send('Unknown service'); if (!html) return res.status(404).send('Unknown service');
res.setHeader('Content-Type', 'text/html; charset=utf-8'); res.setHeader('Content-Type', 'text/html; charset=utf-8');
res.setHeader('Cache-Control', 'no-store'); res.setHeader('Cache-Control', 'no-store');
// This page is a server-rendered shell whose entire auto-login logic runs
// in an inline <script> (no external bundle - it's built per-service in
// buildLoginPage()). The app-wide Helmet CSP sets script-src 'self' with
// no inline exception, which silently blocks that script from ever
// running - no console-visible error on the page, no JS timeout fires,
// it just sits on "Signing in to ..." forever. Relax script-src for this
// one response only; every other route keeps the strict app-wide policy.
res.setHeader('Content-Security-Policy', "default-src 'self'; style-src 'self'; script-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; font-src 'self' data:; object-src 'none'; media-src 'self'; frame-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'");
res.send(html); res.send(html);
}); });