Skip to content

Support CSP nonce on default login and passkey registration pages - #19869

Merged
jzheaux merged 3 commits into
spring-projects:mainfrom
ziqin:gh-19844
Nov 10, 2026
Merged

jzheaux merged 3 commits into
spring-projects:mainfrom
ziqin:gh-19844

Conversation

@ziqin

@ziqin ziqin commented Oct 10, 2026 •

Copy link
Copy Markdown
Contributor

This PR implements gh-19844.

TODOs:

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Oct 10, 2026
@ziqin
ziqin force-pushed the gh-19844 branch 2 times, most recently from 8d2a59d to 7e09a72 Compare October 14, 2026 19:32
@jzheaux

jzheaux commented Oct 14, 2026

Copy link
Copy Markdown
Collaborator

Hi, @ziqin, I've rebased this branch now that #18499 is merged.

Note that your PR caused me to notice #19883, which is now addressed. This altered some of your code, but I believe I preserved the spirit of the change.

When you are ready for review, please let me know. :)

@ziqin
ziqin marked this pull request as ready for review October 15, 2026 01:10
@ziqin

ziqin commented Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Hi, @jzheaux,

Thank you for your help!

Upon reflection, I removed ui.getRegisterForm() from my previous code to simplify maintenance.

Looking forward to your feedback!

@ziqin
ziqin force-pushed the gh-19844 branch 3 times, most recently from 38b7418 to 4243a62 Compare October 15, 2026 02:14
@jzheaux jzheaux self-assigned this Nov 9, 2026
@jzheaux jzheaux added in: web An issue in web modules (web, webmvc) type: bug A general bug and removed status: waiting-for-triage An issue we've not yet triaged labels Nov 9, 2026
@jzheaux jzheaux added this to the 7.2.0 milestone Nov 9, 2026
ziqin and others added 3 commits November 9, 2026 17:27
Placing preventDefault before setupRegistration just in case
setupRegistration fails.

Signed-off-by: Josh Cummings <[email protected]>
Added coverage for missing nonce, HTML-escaped none, and a passkeys-
disabled login page.

Signed-off-by: Josh Cummings <[email protected]>
@jzheaux
jzheaux merged commit 68e1d5e into spring-projects:main Nov 10, 2026
7 checks passed
@jzheaux

jzheaux commented Nov 10, 2026

Copy link
Copy Markdown
Collaborator

Thanks, @ziqin! This is now merged into main. Note that I added some tests in a polish commit and also reordered the event registration in case setupRegistration fails.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in: web An issue in web modules (web, webmvc) type: bug A general bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants