Safety
CSP form-action vs Open Redirects on Public Sites
November 29, 2022
CSP form-action vs open redirects on public sites is two different hops. form-action in Content-Security-Policy tells supporting browsers which origins an HTML form may submit to. An open redirect is a server Location (or meta refresh) that sends the browser — and often a token in the query — to a caller-chosen URL. Restricting form-action to 'self' does not stop /redirect?next=https://evil.example. Allowlisting https://checkout.stripe.com on form-action does not make next= safe. Fix redirects with an allowlist of destinations and no secrets in the URL. RoastMyOpsec follows a bounded public redirect chain and looks at parameter names with values redacted. It does not score missing form-action and does not submit forms.
The practical difference
form-action is a document policy for <form action>. JavaScript-driven navigations and fetch() are not the same control — see connect-src and your app code. Open redirects are origin logic. CSP will not rewrite your /out endpoint.
Password-change and login forms should post to your origin. Payment widgets that post to a PSP need that origin named. Do not use form-action *.
How to choose a policy
Login, signup, and account forms: form-action 'self' (and the canonical host only — www vs apex). Hosted checkout: add the PSP origin you actually post to. Redirect endpoints: allowlist, not CSP. Pair with tokens-in-URLs if reset links still use query strings.
| Control | Stops | Does not stop | Takeaway |
|---|---|---|---|
| CSP form-action | Form POST to surprise origins | Server Location to a user URL | Belt for HTML forms |
| Open-redirect allowlist | Caller-chosen hops off-site | A form with action=https://evil | Fix the endpoint |
| CSRF token + SameSite | Cross-site state change | A first-party redirect bug | Still required |
| Referrer-Policy | Path leaks on navigation | The redirect itself | See URL leaks guide |
What the roast can prove
Redirect chains that leave your public suffix can surface as findings. Missing form-action is not scored. Confirm the CSP directive on the form pages yourself. Heuristic token field names in HTML are CSRF-adjacent, not form-action.
Common mistakes
The first mistake is form-action 'self' on the marketing site and a login form that posts to a different registrable domain with no CSP there.
The second mistake is treating form-action as a WAF for /redirect.
The third mistake is form-action https: which allows any HTTPS origin.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does form-action replace CSRF tokens?
- No. It limits where a form may submit. Tokens and SameSite still belong on cookie-authenticated POSTs.
- Should every brochure site set form-action?
- If you have forms, 'self' is a cheap default. Contact forms that post to a SaaS inbox need that origin named. Missing it is not a roast F.
- Does RoastMyOpsec score form-action?
- No. It does not submit forms. Open-redirect behavior on public hops is a separate check.