CSP frame-src issue when set iframe src SignOutIframeUrl in the view.

[singlewind]

Chrome won't load iframe because the endsession endpoint contains html try to load a client page inside a frame which is different url

[brockallen]

This is true if they're mixed schemes (http/https). Might that be the issue?

[singlewind]

@brockallen I was thinking it is possible to add a content-security-policy header for endsession endpoint which just specify the frame-src , which is the embedded url. Do you think whether there is any security concern? It is may not just http/https. The client domain can be different as well.

[brockallen]

Actually, we'll be making a change related to this: #1224

[brockallen]

Closing this as dup of #1224

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.