OpenConext / OpenConext/OpenConext-engineblock
EB should set (strict) CSP headers on user-facing pages
Open
@baszoetekouw is already working on this.
Since Feb 10, 2026.
- Dominant language
- PHP
- Stars
- 17
- Forks
- 25
- Avg merge
- 4d 1h
- Merged PRs (30d)
- 1
Description
See:
- #1331
- #1332
The best solution would be to let EB set the CSP header instead of relying on webserver logic to insert the header ont eh correct pages.
Concretely, we would like this CSP:
content-security-policy: default-src 'none'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; img-src 'self' https://static.openconex.org http://localhost:* data:; form-action 'self'; frame-ancestors 'none'; base-uri 'none'
to be automatically included on all template-based pages, including (at least):
- WAYF
- consent
- error screens
- service request
- metadata home screen
It should not be included on any pages producing XML (including SAML metadata, requests and assertions).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.