+ {{.}}
+
+
+`))
+
+// sha256 checksum is calculated for the script tag configured in the form.
+//
+// The form and script is generated from github.com/russellhaering/gosaml2 library as part of
+// http-post binding request generation.
+const sha256sum = "'sha256-AjPdJSbZmeWHnEc5ykvJFay8FTWeTeRbs9dutfZ0HqE='"
+
+// TODO(sshah): consolidate security headers used for service provider and identity provider.
+func setSAMLRequestSecurityHeaders(h http.Header) {
+ h.Set("Content-Security-Policy",
+ httplib.GetContentSecurityPolicyString(
+ httplib.CSPMap{
+ "script-src": {sha256sum},
+ "base-uri": {"'none'"},
+ "frame-ancestors": {"'none'"},
+ "object-src": {"'none'"},
+ "img-src": {"'none'"},
+ "style-src": {"'none'"},
+ },
+ ),
+ )
+
+ httplib.SetDefaultSecurityHeaders(h)
+}
diff --git a/lib/saml/request_test.go b/lib/saml/request_test.go
new file mode 100644
index 0000000000000..a8b58ba0deb8e
--- /dev/null
+++ b/lib/saml/request_test.go
@@ -0,0 +1,84 @@
+/*
+ * Teleport
+ * Copyright (C) 2025 Gravitational, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see