a4ade2e7ae
Rendering the SSO buttons as POST forms (#23042) made every SSO login a form submission which NetBox answers with a redirect to the identity provider. Chromium-based browsers evaluate the CSP form-action directive against every hop in a form submission's redirect chain, so a deployment which serves NetBox with `form-action 'self'` blocks that redirect and the button silently does nothing. Add SocialAuthBeginView, which wraps python-social-auth's begin view and returns the identity provider's URL as JSON to clients which request it. The login page now submits the form via fetch() and assigns window.location, which form-action does not govern. The upstream view is reused as-is, so CSRF protection, the callback URL, and the session state recorded for the identity provider are unchanged; clients which do not request JSON (a browser without JavaScript, or a backend which renders an HTML form rather than redirecting) receive the unmodified response as before. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| google.md | ||
| microsoft-entra-id.md | ||
| okta.md | ||
| overview.md | ||