RequireCspFrameSrcForSignout = false does not sign out websites using front channel

[TheJayMann]

I have one client I was configuring which itself wraps another website on a different domain. Under the default settings, it was not being properly signed out on the logout page defined by the QuickStart UI. I found an error in the browser console stating the redirect was not allowed due to the frame-src value. I found that the frame-src could be disabled by setting the RequireCspFrameSrcForSignout property. However, now none of the iframes for the front channel sign out process will load. The browser console says the pages will not load due to the default-src value. The source code shows that this value is being set to 'none', whether or not the RequireCspFrameSrcForSignout is set.

[brockallen]

I think disabling the entire CSP header is this flag is set is the fix.

[brockallen]

Fixed. Please test our nightly build and let me know how it's working.

[TheJayMann]

I wasn't available to test this until today, and, I was able to test with the recently released v2.2 and it worked properly as expected.

[brockallen]

Good to hear. Thanks

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.