glass beadian
7aa99681dd
The oCIS web fetches the OIDC discovery document from the Hub issuer in the browser — connect-src only allowed same-origin + blob, so the fetch was blocked and the web fell back to its own login. With the CSP fix + the external issuer flip, the full SSO chain works: Hub login -> authorize -> consent SPA -> code -> autoprovisioned personal drive.
15 lines
676 B
YAML
15 lines
676 B
YAML
# Minimal ownCloud Web CSP with the office frame origin; oCIS expands ${VAR}.
|
|
directives:
|
|
default-src: ["'none'"]
|
|
child-src: ["'self'"]
|
|
connect-src: ["'self'", "blob:", "https://api.occupymedia.cc"]
|
|
font-src: ["'self'", "data:"]
|
|
# The Hub's in-app Drive view (app.occupymedia.cc/files/drive) frames oCIS web.
|
|
frame-ancestors: ["'self'", "https://app.occupymedia.cc"]
|
|
frame-src: ["'self'", "blob:", "https://${OFFICE_HOST}"]
|
|
img-src: ["'self'", "data:", "blob:", "https://${OFFICE_HOST}"]
|
|
manifest-src: ["'self'"]
|
|
media-src: ["'self'"]
|
|
object-src: ["'self'", "blob:"]
|
|
script-src: ["'self'", "'unsafe-inline'"]
|
|
style-src: ["'self'", "'unsafe-inline'"]
|