coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow registered provider redirects after sign-out confirmation
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 41s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-12 10:47:33 +02:00
parent 91efb6d988
commit 4d8b8fe934
2 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/internal/server/oidc/account.go
View file

@ -49,7 +49,11 @@ func (h *AccountLogoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
w.Header().Set("Cache-Control", "no-store")
// Keep the same-origin POST Origin; no-referrer makes Chromium send Origin: null.
w.Header().Set("Referrer-Policy", "same-origin")
w.Header().Set("Content-Security-Policy", "default-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'")
// Chromium applies form-action to the POST redirect chain as well.
upstream, _ := url.Parse(h.UpstreamLogoutURL)
portal, _ := url.Parse(h.PortalURL)
destinations := upstream.Scheme + "://" + upstream.Host + " " + portal.Scheme + "://" + portal.Host
w.Header().Set("Content-Security-Policy", "default-src 'none'; form-action 'self' "+destinations+"; frame-ancestors 'none'; base-uri 'none'")
w.Header().Set("X-Content-Type-Options", "nosniff")
switch r.Method {
case http.MethodGet: