How to updates CSP policy via environment variables (Docker)

ℹ️ Support
,
1

I need to update nextcloud’s CSP default settings to allow form-action submission from sub-domains such as login.site.com, app.site.com and so on. Nextcloud is hosted as cloud.site.com.

Using latest nextcloud from docker hub (nextcloud:fpm).
Also using vouch to provide OAuth2.0 to protected App. Users are authenticated by nextcloud.

Chrome Error message:

Refused to send form data to 'https://login.XXXX.com.au/' 
because it violates the following Content Security Policy directive: 

https://cloud.XXXX.com.au/login/flow/grant?stateToken=XXX&clientIdentifier=XXX&oauthState=XXX

"form-action 'self' https://app.XXXX.com.au/".

Current nextclud form-action is restricted to self. I think that doesnt allow using nextcloud as SSO server unless hosted on the same host.

my vouch is on a sub-host and I think that is my problem.

Adding something like “*.site.com” might solve my problem.

2

I should add, I have a semi-solution for this problem but its not ideal. That is to edit ContentSecurityPolicy.php and add the trusted domain, submitting form-action, to the array $allowedFormActionDomains.
But that means everytime I remove the docker container - I have to re-edit it.

3

Thanks for the pointer to the php file, it worked perfectly editing that. did you ever find a way to have this set in docker vars? I have my html folder mounted on a volume outside of the container but i think it will still get overwritten when its updated, will have to see on the next update.

To expand on how to manually allow this after updating:
Locate the ContentSecurityPolicy.php located in your container volume, for example mine is

/nextcloud/html/lib/public/AppFramework/Http/ContentSecurityPolicy.php

From there edit this

	/** @var array Domains which can embed this Nextcloud instance */
	protected $allowedFrameAncestors = [
		'\'self\' https://*.yourdomain.url https://yourdomain.url',
	];

replace yourdomain.url with the page you are allowing to embed

edit:
for those that find this method in the future. using the hide toolbars app is a much easier way of doing this. on top of allowing the headers to be hidden it exposes a way of allowing CSP urls directly in the config.php
see more details here