Migrations/bookorbit
1
0
Fork 0
mirror of https://github.com/bookorbit/bookorbit.git synced 2026-11-03 08:21:39 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): allow https in csp img-src for oidc provider icons (#140)

Browse Source 
The Content Security Policy was previously blocking external images,
preventing admin-configured OIDC provider icons from loading.
This allows https: images to be loaded while continuing to block
plain http: to maintain mixed-content protection.

Closes #131
This commit is contained in:
neon
2026-05-30 12:28:09 -06:00
committed by GitHub
parent a1fe471e83
commit 3f6f7163d8
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/common/utils/bootstrap.utils.test.ts
+8 -2
View File
@@ -191,9 +191,15 @@ describe('buildCspDirectives', () => {
});
describe('static directives', () => {
it('imgSrc allows self, data, and blob', () => {
it('imgSrc allows self, data, blob, and https (for admin-configured OIDC provider icons)', () => {
const { imgSrc } = buildCspDirectives();
expect(imgSrc).toEqual(["'self'", 'data:', 'blob:']);
expect(imgSrc).toEqual(["'self'", 'data:', 'blob:', 'https:']);
});
it('imgSrc does not allow plain http to keep mixed-content protection', () => {
const { imgSrc } = buildCspDirectives();
expect(imgSrc).not.toContain('http:');
expect(imgSrc).not.toContain('*');
});
it('mediaSrc allows self, data, and blob', () => {
server/src/common/utils/bootstrap.utils.ts
+1 -1
View File
@@ -41,7 +41,7 @@ export function buildCspDirectives(options: CspOptions = {}) {
defaultSrc: ["'self'"],
scriptSrc,
styleSrc: ["'self'", "'unsafe-inline'", 'blob:', 'https://fonts.googleapis.com'],
imgSrc: ["'self'", 'data:', 'blob:'],
imgSrc: ["'self'", 'data:', 'blob:', 'https:'],
connectSrc,
mediaSrc: ["'self'", 'data:', 'blob:'],
fontSrc: ["'self'", 'data:', 'blob:', 'https://fonts.gstatic.com'],