Workaround · Permissions & security · Annoyance
Customizing CSP requires overriding the whole header
1 source thread · first seen 2023-01
Summary
The only way to tune CSP today is to completely override the header, which weakens it across all Keycloak endpoints.
- Workaround
- Override the entire CSP header.
Evidence
Excerpts are copied word for word from the source; follow the link to read it in full.
“Currently this is done by completely overriding the header, but this is not great as it results in a less secure CSP header”