diff --git a/samlsp/middleware.go b/samlsp/middleware.go
index bcad9fdc..f3ee472f 100644
--- a/samlsp/middleware.go
+++ b/samlsp/middleware.go
@@ -160,11 +160,10 @@ func (m *Middleware) RequireAccount(handler http.Handler) http.Handler {
return
}
if binding == saml.HTTPPostBinding {
- w.Header().Set("Content-Security-Policy", ""+
+ w.Header().Add("Content-Security-Policy", ""+
"default-src; "+
- "script-src 'sha256-D8xB+y+rJ90RmLdP72xBqEEc0NUatn7yuCND0orkrgk='; "+
- "reflected-xss block; "+
- "referrer no-referrer;")
+ "script-src 'sha256-AjPdJSbZmeWHnEc5ykvJFay8FTWeTeRbs9dutfZ0HqE='; "+
+ "reflected-xss block; referrer no-referrer;")
w.Header().Add("Content-type", "text/html")
w.Write([]byte(``))
w.Write(req.Post(relayState))
@@ -243,7 +242,7 @@ func (m *Middleware) Authorize(w http.ResponseWriter, r *http.Request, assertion
// delete the cookie
stateCookie.Value = ""
- stateCookie.Expires = time.Unix(1,0) // past time as close to epoch as possible, but not zero time.Time{}
+ stateCookie.Expires = time.Unix(1, 0) // past time as close to epoch as possible, but not zero time.Time{}
http.SetCookie(w, stateCookie)
}
diff --git a/samlsp/middleware_test.go b/samlsp/middleware_test.go
index 30714bde..0b2a51e3 100644
--- a/samlsp/middleware_test.go
+++ b/samlsp/middleware_test.go
@@ -176,13 +176,13 @@ func (test *MiddlewareTest) TestRequireAccountNoCredsPostBinding(c *C) {
""+
""+
""+
- ""+
- ""+
+ ""+
""+
"")
// check that the CSP script hash is set correctly
- scriptContent := "document.getElementById('SAMLRequestForm').submit();"
+ scriptContent := "document.getElementById('SAMLSubmitButton').style.visibility=\"hidden\";document.getElementById('SAMLRequestForm').submit();"
scriptSum := sha256.Sum256([]byte(scriptContent))
scriptHash := base64.StdEncoding.EncodeToString(scriptSum[:])
c.Assert(resp.Header().Get("Content-Security-Policy"), Equals,
diff --git a/service_provider.go b/service_provider.go
index ca00a4b2..60df024f 100644
--- a/service_provider.go
+++ b/service_provider.go
@@ -304,8 +304,8 @@ func (req *AuthnRequest) Post(relayState string) []byte {
`` +
`` +
`` +
- `` +
- ``))
+ ``))
data := struct {
URL string
SAMLRequest string
diff --git a/service_provider_test.go b/service_provider_test.go
index 55ad9751..192cc69d 100644
--- a/service_provider_test.go
+++ b/service_provider_test.go
@@ -188,8 +188,8 @@ func (test *ServiceProviderTest) TestCanProducePostRequest(c *C) {
``+
``+
``+
- ``+
- ``)
+ ``)
}
func (test *ServiceProviderTest) TestCanHandleOneloginResponse(c *C) {