Automatic configuration of Content Security Policy form-action for Social Auth

[michael-smt]

Describe the problem

The stricter Content Security Policy since Weblate 5.7 requires careful configuration of the CSP_FORM_SRC when using social authentication providers, because some browsers block redirects after a form submission.

Describe the solution you would like

It would be nice if enabling a social auth provider would also automatically set the appropriate form-action Content Security Policy header values.

For example when WEBLATE_SOCIAL_AUTH_AUTH0_DOMAIN is configured it could be automatically added to WEBLATE_CSP_FORM_SRC.

Describe alternatives you have considered

Describe the required setting of CSP_FORM_SRC in the social provider documentation based on the experience from hosted.weblate.org.

Screenshots

No response

Additional context

Depending on the provider (Auth0, possibly also others) there might be additional redirects to other authentication providers, these could not be automatically configured.

[nijel]

The intention was to handle that automatically, but the code doesn't cover all the cases:

weblate/weblate/middleware.py

Lines 336 to 347 in 9259f38

	# Third-party login flow extensions
	if request.resolver_match and (
	request.resolver_match.view_name.startswith("social:")
	or request.resolver_match.view_name in {"login", "profile"}
	):
	for backend in get_auth_backends().values():
	# Handle OpenId redirect flow
	if issubclass(backend, OpenIdAuth) and backend.URL:
	form.add(urlparse(backend.URL).hostname)
	# Handle OAuth redirect flow
	if issubclass(backend, OAuthAuth) and backend.AUTHORIZATION_URL:
	form.add(urlparse(backend.AUTHORIZATION_URL).hostname)

PS: There is also #12302

PS2: I think in both cases it would be addressed by using authorization_url() method instead of AUTHORIZATION_URL atribute.

[github-actions]

Thank you for your report; the issue you have reported has just been fixed.

• In case you see a problem with the fix, please comment on this issue.
• In case you see a similar problem, please open a separate issue.
• If you are happy with the outcome, don’t hesitate to support Weblate by making a donation.

[github-actions]

Thank you for your report; the issue you have reported has just been fixed.

• In case you see a problem with the fix, please comment on this issue.
• In case you see a similar problem, please open a separate issue.
• If you are happy with the outcome, don’t hesitate to support Weblate by making a donation.