Make sure djangosaml2 works in csp-enabled applications too (fix #391)

djangosaml2/views.py

@@ -76,6 +76,21 @@
     validate_referral_url,
 )
 
+# Update Content-Security-Policy headers for POST-Bindings
+try:
+    from csp.decorators import csp_update
+except ModuleNotFoundError:
+    # If csp is not installed, do not update fields as Content-Security-Policy
+    # is not used
+    def saml2_csp_update(view):
+        return view
+else:
+    # script-src 'unsafe-inline' to autosubmit forms,
+    # form-action https: to send data to IdPs
+    saml2_csp_update = csp_update(
+        SCRIPT_SRC=["'unsafe-inline'"], FORM_ACTION=["https:"]
+    )
+
 logger = logging.getLogger("djangosaml2")
 
 
@@ -123,6 +138,7 @@ def get_state_client(self, request: HttpRequest):
         return state, client
 
 
+@method_decorator(saml2_csp_update, name='dispatch')
 class LoginView(SPConfigMixin, View):
     """SAML Authorization Request initiator.
 
@@ -671,6 +687,7 @@ def get(self, request, *args, **kwargs):
         )
 
 
+@method_decorator(saml2_csp_update, name='dispatch')
 class LogoutInitView(LoginRequiredMixin, SPConfigMixin, View):
     """SAML Logout Request initiator
 
@@ -749,7 +766,7 @@ def handle_unsupported_slo_exception(self, request, exception, *args, **kwargs):
         return HttpResponseRedirect(getattr(settings, "LOGOUT_REDIRECT_URL", "/"))
 
 
-@method_decorator(csrf_exempt, name="dispatch")
+@method_decorator([saml2_csp_update, csrf_exempt], name="dispatch")
 class LogoutView(SPConfigMixin, View):
     """SAML Logout Response endpoint
 

docs/source/contents/security.md

@@ -0,0 +1,20 @@
+Security considerations
+=======================
+
+Authentication and Authorization are quite security relevant topics on its own.
+Make sure you understand SAML2 and its implications, specifically the
+separation of duties between Service Provider (SP) and Identity Provider (IdP):
+This Library aims to support a Service Provider in running Authentication
+against one or more IdP.
+
+Communication between SP and IdP is routed via the Browser, eliminating the
+need for direct communication between SP and IdP. However, for security the use
+of cryptographic signatures (both while sending and receiving messages) must be
+examined and the private keys in use must be kept closely guarded.
+
+When using POST-Bindings, the Browser is presented with a small HTML-Form for
+every redirect (both Login and Logout), which is sent using JavaScript and
+sends the Data to the selected IdP. If your application uses technices such as
+Content Security Policy, this might affect the calls. Since Version 1.9.0
+djangosaml2 will detect if django-csp is installed and update the Content
+Security Policy accordingly.

docs/source/index.rst

@@ -41,3 +41,9 @@ under the `Apache 2.0 <https://en.wikipedia.org/wiki/Apache_License>`_.
    :caption: FAQ
 
    contents/faq.md
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Security considerations
+
+   contents/security.md

setup.py

@@ -27,7 +27,7 @@ def read(*rnames):
 
 setup(
     name="djangosaml2",
-    version="1.8.0",
+    version="1.9.0",
     description="pysaml2 integration for Django",
     long_description=read("README.md"),
     long_description_content_type="text/markdown",