package oidc import ( "crypto/sha256" "encoding/base64" "html/template" ) // formPostAutoSubmitScript submits the response_mode=form_post page back to the client as soon as it loads // Pocket ID's Content-Security-Policy forbids 'unsafe-inline' scripts and inline event handlers, which is exactly what fosite's default form_post template relies on (), so that page silently never submits and strands the user on a blank page // We instead deliver the auto-submit as a regular inline `)) // cspHashOf returns the CSP hash-source expression ("'sha256-...'") for an inline script body func cspHashOf(script string) string { sum := sha256.Sum256([]byte(script)) return "'sha256-" + base64.StdEncoding.EncodeToString(sum[:]) + "'" }