Login Chooser breaks after 77.35 -> 78.0 update

[robl-sap]

Hi colleagues,

we bumped the cf uaa version from 77.35 to 78.0.

After the update its not possible anymore to login when the account chooser is enabled.

When you are not logged in yet, we see

/login --(login with default idp)--> /origin-chooser --> /login?error=invalid_login_request

But the error message is not present in the UI.

[strehle]

I tried to simulate this on our Dev, but I cannot see the error.

The error reason is, that X-Uaa-Csrf cookie is not available and then login screen is runs into CSRF error which shows this page.

A maybe workaround would be to switch to get here: https://github.com/cloudfoundry/uaa/blob/develop/server/src/main/resources/templates/web/idp_discovery/account_chooser.html#L25 then we would not run into CSRF checks at all....

[muczynskicofense]

Maybe it's related to

Content-Security-Policy: The page's settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: "script-src 'self' 'sha256-ePniVEkSivX/c7XWBGafqh8tSpiRrKiqYeqbG7N1TOE=' 'sha256-4RS22DYeB7U14dra4KcQYxmwt5HkOInieXK1NUMBmQI=' 'unsafe-hashes'"

[strehle]

Maybe it's related to

Content-Security-Policy: The page's settings blocked an inline script (script-src-elem) from being executed because it violates the following directive: "script-src 'self' 'sha256-ePniVEkSivX/c7XWBGafqh8tSpiRrKiqYeqbG7N1TOE=' 'sha256-4RS22DYeB7U14dra4KcQYxmwt5HkOInieXK1NUMBmQI=' 'unsafe-hashes'"

no it was really the Cookie load / create step. With spring security 6 the cookie is not created always.... tested a manual fix .. will cretae 78.1.0 soon

[strehle]

@muczynskicofense if you have set uaa.csp.script-src in your deployment and you have defined the hash, e.g.

script-src

Please create a new because we have change with v78 almost all templates because of thymeleaf adoption

By default we do not ship a hash but set only "'self' so just check if you upgrade to v78.

The issue reported here is solved in meanwhile