The OIDC provider was falling back to config.public.appUrl for its issuer, which could resolve to an http:// URL. This caused the logout form action to use http://, violating the CSP form-action directive. Hardcode the issuer fallback to https://ghostguild.org. |
||
|---|---|---|
| .. | ||
| auth.js | ||
| escapeHtml.js | ||
| helcim.js | ||
| mongoose.js | ||
| oidc-mongodb-adapter.ts | ||
| oidc-provider.ts | ||
| resend.js | ||
| schemas.js | ||
| slack.ts | ||
| tickets.js | ||
| validateBody.js | ||