Merge pull request #593 from jrafanie/fix-bricked-oidc-login-from-csp

Update CSP to allow unsafe-inline for oidc login endpoints

Author: Fryguy

external_auth/oidc-httpd-configs/authentication.conf

@@ -25,14 +25,14 @@ OIDCOAuthSSLValidateServer         Off
 Header always set Strict-Transport-Security "max-age=631138519"
 Header always set X-Content-Type-Options "nosniff"
 
-# Minimal CSP for OIDC authentication redirects (no scripts, images, or external resources)
+# CSP for OIDC authentication redirects - allows inline styles/scripts needed by auth flow
 <Location /oidc_login>
   AuthType                   openid-connect
   Require                    valid-user
   FileETag                   None
   # Explicit HSTS for redundancy
   Header always set Strict-Transport-Security "max-age=631138519"
-  Header set Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
+  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
   Header set Report-To       "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/dashboard/csp_report\"}]}"
   Header Set Cache-Control   "max-age=0, no-store, no-cache, must-revalidate"
   Header Set Pragma          "no-cache"
@@ -45,7 +45,7 @@ Header always set X-Content-Type-Options "nosniff"
   FileETag                   None
   # Explicit HSTS for redundancy
   Header always set Strict-Transport-Security "max-age=631138519"
-  Header set Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
+  Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
   Header set Report-To       "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/dashboard/csp_report\"}]}"
   Header Set Cache-Control   "max-age=0, no-store, no-cache, must-revalidate"
   Header Set Pragma          "no-cache"