From e6a15336077c75b5ea307e7402e3c3c047cb3536 Mon Sep 17 00:00:00 2001 From: Thomas Luizon Rodrigues Gregorio Date: Sat, 28 Mar 2026 21:07:02 -0300 Subject: [PATCH] fix: replace deprecated GoogleCredential + remove CSP from API - Use CredentialFactory.FromJson().ToGoogleCredential() to resolve CS0618 warnings without breaking Firebase init - Remove Content-Security-Policy from API middleware (inappropriate for REST API, was causing issues when headers leaked through proxy) Co-Authored-By: Claude Opus 4.6 (1M context) --- src/Orbit.Api/Middleware/SecurityHeadersMiddleware.cs | 1 - src/Orbit.Api/Program.cs | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/src/Orbit.Api/Middleware/SecurityHeadersMiddleware.cs b/src/Orbit.Api/Middleware/SecurityHeadersMiddleware.cs index 8dc4032d..fe59ac0f 100644 --- a/src/Orbit.Api/Middleware/SecurityHeadersMiddleware.cs +++ b/src/Orbit.Api/Middleware/SecurityHeadersMiddleware.cs @@ -10,7 +10,6 @@ public Task InvokeAsync(HttpContext context) headers["Referrer-Policy"] = "strict-origin-when-cross-origin"; headers["X-XSS-Protection"] = "0"; headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"; - headers["Content-Security-Policy"] = "default-src 'self'"; return next(context); } diff --git a/src/Orbit.Api/Program.cs b/src/Orbit.Api/Program.cs index ac3762c5..69a2edbb 100644 --- a/src/Orbit.Api/Program.cs +++ b/src/Orbit.Api/Program.cs @@ -93,7 +93,7 @@ { FirebaseAdmin.FirebaseApp.Create(new FirebaseAdmin.AppOptions { - Credential = Google.Apis.Auth.OAuth2.GoogleCredential.FromJson(firebaseCredJson) + Credential = Google.Apis.Auth.OAuth2.CredentialFactory.FromJson(firebaseCredJson).ToGoogleCredential() }); } else @@ -103,7 +103,7 @@ { FirebaseAdmin.FirebaseApp.Create(new FirebaseAdmin.AppOptions { - Credential = Google.Apis.Auth.OAuth2.GoogleCredential.FromFile(firebaseCredPath) + Credential = Google.Apis.Auth.OAuth2.CredentialFactory.FromFile(firebaseCredPath).ToGoogleCredential() }); } }