From 0de42c731ae1472bf0499551e35652431716541b Mon Sep 17 00:00:00 2001 From: Bryan Brooks Date: Thu, 19 Feb 2026 15:54:09 -0600 Subject: [PATCH] fix: remove form-action CSP to allow Chrome OIDC redirects Chrome enforces form-action 'self' on redirect targets, not just the form action URL. When the login form POSTs to /oauth/authorize/login and the response is a 302 to bsky.social, Chrome silently blocks the redirect. Firefox only checks the action attribute, so it works. Removing the form-action directive fixes Chrome login. The form still only POSTs to self (hardcoded in HTML), so this doesn't reduce security. --- gateway/src/index.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/gateway/src/index.ts b/gateway/src/index.ts index 320f1d9..ad663e2 100644 --- a/gateway/src/index.ts +++ b/gateway/src/index.ts @@ -166,6 +166,15 @@ async function main(): Promise { // Middleware app.use(helmet({ crossOriginResourcePolicy: { policy: 'cross-origin' }, + contentSecurityPolicy: { + directives: { + ...helmet.contentSecurityPolicy.getDefaultDirectives(), + // Chrome enforces form-action on redirect targets (not just the action URL). + // The OIDC login form POSTs to self, but the response redirects to bsky.social + // or other PDS hosts. Without this, Chrome blocks the redirect silently. + 'form-action': null, + }, + }, })); app.use(cors({ origin: config.corsOrigins, -- knotmirror 0.0.1