CSP form-action
Where forms may submit. Does not fall back to default-src.
- Falls back to
- nothing — must be set explicitly
- Group
- Document and navigation directives
Detail
Without it, an injected form — or a rewritten action attribute on your own login form — can post credentials to any origin. CSP cannot stop the form rendering, but form-action 'self' stops the submission leaving your origin.
Example
form-action 'self'