Skip to content

Drop only CSP header when oidcDropCspHeaders is set, not CORS headers

Yadd requested to merge dropCsp-drop-csp-only into v2.0

When relying party is the browser, Chromium refuses to query OIDC endpoints without CORS headers

Merge request reports