You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
CSP Error with script history.replaceState() During Flow Transitions (Keycloak 23.0.4) when I remove unsafe-inline
#30074
I'm facing a Content Security Policy (CSP) error in Keycloak 23.0.4 when attempting to remove unsafe-inline. The error is triggered by a script that Keycloak injects, which utilizes history.replaceState(). This issue specifically arises during transitions between different authentication flows (e.g., from the login page to the username recovery page).
The problematic script appears to be dynamically generated by Keycloak's backend, making it difficult to apply standard CSP workarounds like nonces or hashes.
Expected Behavior:
Keycloak should function correctly with a strict CSP that prohibits unsafe-inline, without generating errors during flow transitions.
Any insights, suggestions, or known workarounds?
Thank you!
Same with 26.1.3. We are using the default CSP within Realm Settings -> Security Defenses: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
This happens during authentication flow transitions between subdomains. I want the browser to be able to process this code block, but haven't been able to figure out a workaround through updating Keycloak's CSP using script-src or script-src-elem props. If it worked, I would assume that Keycloak could inject a nonce prop to match this injection.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Hello Keycloak community,
I'm facing a Content Security Policy (CSP) error in Keycloak 23.0.4 when attempting to remove unsafe-inline. The error is triggered by a script that Keycloak injects, which utilizes history.replaceState(). This issue specifically arises during transitions between different authentication flows (e.g., from the login page to the username recovery page).
The problematic script appears to be dynamically generated by Keycloak's backend, making it difficult to apply standard CSP workarounds like nonces or hashes.
Expected Behavior:
Keycloak should function correctly with a strict CSP that prohibits unsafe-inline, without generating errors during flow transitions.
Any insights, suggestions, or known workarounds?
Thank you!
All reactions
Replies: 3 comments
Uh oh!
There was an error while loading. Please reload this page.
Still a problem in version 26.0.5
All reactions
Uh oh!
There was an error while loading. Please reload this page.
Same with 26.1.3. We are using the default CSP within Realm Settings -> Security Defenses:
frame-src 'self'; frame-ancestors 'self'; object-src 'none';This happens during authentication flow transitions between subdomains. I want the browser to be able to process this code block, but haven't been able to figure out a workaround through updating Keycloak's CSP using
script-srcorscript-src-elemprops. If it worked, I would assume that Keycloak could inject a nonce prop to match this injection.keycloak/services/src/main/java/org/keycloak/services/util/BrowserHistoryHelper.java
Lines 111 to 135 in c11d93d
All reactions
Uh oh!
There was an error while loading. Please reload this page.
Did anyone manage to resolve this?
All reactions