Feature: Option to register SSO Domain for CSP header

[valentin-ok]

Hi,

if you toggle the SSO redirect, you'll get a CSP Error when the SSO provider is on a different domain than the matrix server.

It would be great if we could have a field when toggling this switch to input the SSO server to register it with the CSP headers without modifying the nextcloud source code.

Best regards

[pasith3e]

Hi,

from my testing is this a two sited Issue which also needs changes on the Matrix Server Side.
On my Nginx Ingress Controller for Kubernetes I added for the Synapse Ingress:

   nginx.ingress.kubernetes.io/server-snippet: |
      more_set_headers "Content-Security-Policy: frame-ancestors https://$NEXTCLOUD_DOMAIN";

And for Nextcloud Ingress:

    nginx.ingress.kubernetes.io/server-snippet: |
      more_set_headers "Content-Security-Policy: default-src 'none';base-uri 'none';manifest-src 'self';script-src $NEXTCLOUD_DOMAIN 'unsafe-eval' 'unsafe-inline';style-src 'self' 'unsafe-inline';img-src 'self' data: blob: *;font-src 'self' data:;connect-src 'self' *;media-src 'self' * blob: ;object-src *;frame-src 'self' blob: *;frame-ancestors $SSO_DOMAIN 'self' $NEXTCLOUD_DOMAIN;form-action 'self'";

I'm sure you don´t need all the parameters but this works for me

[craigify]

Thanks for making me realize that I could use the reverse proxies to handle this. I run apache instead of nginx.

On Synapse I added the following Apache directive so that it would modify the header only in the authn response workflow. This allows Synapse to run inside of the iframe:

<Location /_synapse/client/saml2/authn_response>
  Header set Content-Security-Policy "frame-ancestors https://nextcloud.domain.com;"
  Header unset X-Frame-Options
</Location>

Then on the apache reverse proxy for nextcloud. This allows nextcloud to load riotchat, the SSO login page, and the matrix authN response page inside of the iframe:

<LocationMatch /apps/riotchat>
  Header unset Content-Security-Policy
  Header always set Content-Security-Policy "frame-src 'self' https://nextcloud.domain.com https://matrix.domain.com https://sso.domain.com; frame-ancestors 'self';>
</LocationMatch>