Fix #878 - Add OIDC Metadata URL to CSP header Frame ancessor

CGI-FR · Jun 30, 2022 · c00351b · c00351b
1 parent 50f741c
commit c00351b
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/src/AzureIoTHub.Portal/Server/Startup.cs b/src/AzureIoTHub.Portal/Server/Startup.cs
@@ -279,7 +279,15 @@ public async void Configure(IApplicationBuilder app, IWebHostEnvironment env)
             _ = app.UseProblemDetails();
             app.UseIfElse(IsApiRequest, UseApiExceptionMiddleware, UseUIExceptionMiddleware);
 
-            _ = app.UseSecurityHeaders();
+            _ = app.UseSecurityHeaders(opts =>
+            {
+                _= opts.AddContentSecurityPolicy(csp =>
+                {
+                    _ = csp.AddFrameAncestors()
+                        .Self()
+                        .From(app.ApplicationServices.GetService<ConfigHandler>().OIDCMetadataUrl);
+                });
+            });
 
             if (env.IsDevelopment())
             {