From b75f96cb1c29163ff6b824766a49abf049041f1e Mon Sep 17 00:00:00 2001 From: si458 Date: Wed, 16 Apr 2025 15:06:59 +0100 Subject: [PATCH] fix duo with csp and chrome/edge Signed-off-by: si458 --- webserver.js | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/webserver.js b/webserver.js index 1d3abecb..12085466 100644 --- a/webserver.js +++ b/webserver.js @@ -6719,13 +6719,20 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF extraFrameSrc = ' https://' + req.headers.host + ':' + parent.webrelayserver.port; if ((xforwardedhost != null) && (xforwardedhost != req.headers.host)) { extraFrameSrc += ' https://' + xforwardedhost + ':' + parent.webrelayserver.port; } } + + // If using duo add apihostname to CSP + var duoSrc = ''; + if ((typeof domain.duo2factor == 'object') && (typeof domain.duo2factor.apihostname == 'string')) { + duoSrc = domain.duo2factor.apihostname; + } + // Finish setup security headers const headers = { 'Referrer-Policy': 'no-referrer', 'X-XSS-Protection': '1; mode=block', 'X-Content-Type-Options': 'nosniff', - 'Content-Security-Policy': "default-src 'none'; font-src 'self' fonts.gstatic.com data:; script-src 'self' 'unsafe-inline' " + extraScriptSrc + "; connect-src 'self'" + geourl + selfurl + "; img-src 'self' blob: data:" + geourl + " data:; style-src 'self' 'unsafe-inline' fonts.googleapis.com; frame-src 'self' blob: mcrouter:" + extraFrameSrc + "; media-src 'self'; form-action 'self'; manifest-src 'self'" + 'Content-Security-Policy': "default-src 'none'; font-src 'self' fonts.gstatic.com data:; script-src 'self' 'unsafe-inline' " + extraScriptSrc + "; connect-src 'self'" + geourl + selfurl + "; img-src 'self' blob: data:" + geourl + " data:; style-src 'self' 'unsafe-inline' fonts.googleapis.com; frame-src 'self' blob: mcrouter:" + extraFrameSrc + "; media-src 'self'; form-action 'self' " + duoSrc + "; manifest-src 'self'" }; if (req.headers['user-agent'] && (req.headers['user-agent'].indexOf('Chrome') >= 0)) { headers['Permissions-Policy'] = 'interest-cohort=()'; } // Remove Google's FLoC Network, only send this if Chrome browser if ((parent.config.settings.allowframing !== true) && (typeof parent.config.settings.allowframing !== 'string')) { headers['X-Frame-Options'] = 'sameorigin'; }