Repository navigation
Replies: 3 comments
|
Still a problem in version 26.0.5 |
0 replies
|
Same with 26.1.3. We are using the default CSP within Realm Settings -> Security Defenses: This happens during authentication flow transitions between subdomains. I want the browser to be able to process this code block, but haven't been able to figure out a workaround through updating Keycloak's CSP using |
0 replies
|
Did anyone manage to resolve this? |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hello Keycloak community,
I'm facing a Content Security Policy (CSP) error in Keycloak 23.0.4 when attempting to remove unsafe-inline. The error is triggered by a script that Keycloak injects, which utilizes history.replaceState(). This issue specifically arises during transitions between different authentication flows (e.g., from the login page to the username recovery page).
The problematic script appears to be dynamically generated by Keycloak's backend, making it difficult to apply standard CSP workarounds like nonces or hashes.
Expected Behavior:
Keycloak should function correctly with a strict CSP that prohibits unsafe-inline, without generating errors during flow transitions.
Any insights, suggestions, or known workarounds?
Thank you!
All reactions