Chrome enforces form-action 'self' on redirect targets, not just the form action URL. When the login form POSTs to /oauth/authorize/login and the response is a 302 to bsky.social, Chrome silently blocks the redirect. Firefox only checks the action attribute, so it works. Removing the form-action directive fixes Chrome login. The form still only POSTs to self (hardcoded in HTML), so this doesn't reduce security.