fix: allow same-origin fetch in CSP when inline login script is used #9

Merged

andrew merged 1 commits from fix/csp-connect-src-inline-script into main 2026-08-17 19:05:16 -04:00

Conversation 1 Commits 1 Files Changed 1

+24 -5

lyra commented 2026-08-17 11:28:35 -04:00

Member

Copy Link

Copy Source

Problem

When subdomain redirection is off, the login form is served inline on the protected host and submission happens via a same-origin fetch() call in _script.html.twig. The CSP default-src 'none' was blocking that fetch (connect-src falls back to default-src), producing:

Content-Security-Policy: The page's settings blocked the loading of a resource (connect-src) ... it violates the following directive: "default-src 'none'"

Fix

Add connect-src 'self' to the CSP only when the request is not on the auth subdomain (i.e. when the inline script is present and the form submits via JS). On the auth subdomain the form POSTs normally with no inline script, so the stricter policy still applies there.

This is the least-privilege relaxation: only same-origin connections, only on pages that need them.

+ $inlineScript = $this->domainManager->getAuthSubdomain() !== $event->getRequest()->getHost();
  $csp          = "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline';";
+ if ($inlineScript) {
+     $csp .= " connect-src 'self';";
+ }

Testing

All 295 existing tests pass. php-cs-fixer clean.

## Problem When subdomain redirection is off, the login form is served inline on the protected host and submission happens via a same-origin `fetch()` call in `_script.html.twig`. The CSP `default-src 'none'` was blocking that fetch (`connect-src` falls back to `default-src`), producing: ``` Content-Security-Policy: The page's settings blocked the loading of a resource (connect-src) ... it violates the following directive: "default-src 'none'" ``` ## Fix Add `connect-src 'self'` to the CSP **only** when the request is not on the auth subdomain (i.e. when the inline script is present and the form submits via JS). On the auth subdomain the form POSTs normally with no inline script, so the stricter policy still applies there. This is the least-privilege relaxation: only same-origin connections, only on pages that need them. ```diff + $inlineScript = $this->domainManager->getAuthSubdomain() !== $event->getRequest()->getHost(); $csp = "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline';"; + if ($inlineScript) { + $csp .= " connect-src 'self';"; + } ``` ## Testing All 295 existing tests pass. php-cs-fixer clean.

lyra added 1 commit 2026-08-17 11:28:35 -04:00

fix: allow same-origin fetch in CSP when inline login script is used ... e2780ca5f6

When subdomain redirection is off, the login form is served inline on
the protected host and submission happens via a same-origin fetch() call
in _script.html.twig. The CSP default-src 'none' was blocking that
fetch (connect-src falls back to default-src).

Add connect-src 'self' to the CSP only when the request is not on the
auth subdomain (i.e. when the inline script is present). On the auth
subdomain the form POSTs normally with no inline script, so the stricter
policy still applies there.

This is the least-privilege relaxation: only same-origin connections,
only on pages that need them.

andrew approved these changes 2026-08-17 19:05:09 -04:00

andrew merged commit e2780ca5f6 into main 2026-08-17 19:05:16 -04:00

andrew deleted branch fix/csp-connect-src-inline-script 2026-08-17 19:05:16 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

andrew

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

andrew (Andrew) lyra

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: public/preauth#9