Function GenerateCSPString

pkg/identityserver/identityserver.go:90–124

GenerateCSPString returns a Content-Security-Policy header value for OAuth and Account app template.

(config *oauth.Config, nonce string)

// GenerateCSPString returns a Content-Security-Policy header value
// for OAuth and Account app template.
func GenerateCSPString(config *oauth.Config, nonce string) string {
	baseURLs := webui.RewriteSchemes(
		webui.WebsocketSchemeRewrites,
		config.UI.StackConfig.IS.BaseURL,
	)
	return webui.ContentSecurityPolicy{
		ConnectionSource: append([]string{
			"'self'",
			config.UI.SentryDSN,
			config.UI.StatusPage,
			"gravatar.com",
			"www.gravatar.com",
		}, baseURLs...),
		StyleSource: []string{
			"'self'",
			config.UI.AssetsBaseURL,
			config.UI.BrandingBaseURL,
			"'unsafe-inline'",
		},
		ScriptSource: []string{
			"'self'",
			config.UI.AssetsBaseURL,
			config.UI.BrandingBaseURL,
			"'unsafe-eval'",
			"'strict-dynamic'",
			fmt.Sprintf("'nonce-%s'", nonce),
		},
		BaseURI: []string{
			"'self'",
		},
		FrameAncestors: []string{
			"'none'",
		},
	}.Clean().String()
}

type accountAppStore struct {
	store.TransactionalStore