hacklab/T-HUB
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

files: allow api.occupymedia.cc in the oCIS CSP connect-src

Browse source 
The oCIS web fetches the OIDC discovery document from the Hub issuer in the
browser — connect-src only allowed same-origin + blob, so the fetch was
blocked and the web fell back to its own login. With the CSP fix + the
external issuer flip, the full SSO chain works: Hub login -> authorize ->
consent SPA -> code -> autoprovisioned personal drive.
This commit is contained in:
glass beadian 2026-10-13 19:07:32 +00:00
parent 3117e1c18e
commit 7aa99681dd
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
infra/occupymedia/files/csp.yaml
View file

@ -2,7 +2,7 @@
directives:
default-src: ["'none'"]
child-src: ["'self'"]
connect-src: ["'self'", "blob:"]
connect-src: ["'self'", "blob:", "https://api.occupymedia.cc"]
font-src: ["'self'", "data:"]
# The Hub's in-app Drive view (app.occupymedia.cc/files/drive) frames oCIS web.
frame-ancestors: ["'self'", "https://app.occupymedia.cc"]