Let the consent form's redirect reach the app

backend/internal/handler/oauthconsent/consent.go

@@ -224,6 +224,7 @@ type page struct {
 	Email        string
 	Token        string
 	Nonce        string
+	FormAction   string // the CSP form-action sources
 }
 
 func newPage(req Request, token string) page {
@@ -235,9 +236,27 @@ func newPage(req Request, token string) page {
 		Destination:  destination(req.Consent.RedirectURI),
 		Email:        req.Email,
 		Token:        token,
+		FormAction:   "'self' " + formActionSource(req.Consent.RedirectURI),
 	}
 }
 
+// formActionSource is where the form may end up. Chrome checks form-action
+// against the redirect a POST answers with too, so 'self' alone blocks the
+// redirect to the app and Allow does nothing. The redirect URI was checked,
+// so its scheme and host hold no CSP syntax.
+func formActionSource(redirectURI string) string {
+	u, _ := url.Parse(redirectURI)
+	if !isWeb(u) {
+		return u.Scheme + ":"
+	}
+	// An IP literal ([::1]) is not a host-source CSP matches reliably.
+	if net.ParseIP(u.Hostname()) != nil {
+		return u.Scheme + ":"
+	}
+	host, _ := displayHost(u)
+	return u.Scheme + "://" + host
+}
+
 func render(w http.ResponseWriter, p page) {
 	p.Nonce = rand.Text()
 	h := w.Header()
@@ -248,7 +267,7 @@ func render(w http.ResponseWriter, p page) {
 	h.Set("X-Frame-Options", "DENY")
 	h.Set("X-Content-Type-Options", "nosniff")
 	h.Set("Referrer-Policy", "no-referrer")
-	h.Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-"+p.Nonce+"'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'")
+	h.Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-"+p.Nonce+"'; form-action "+p.FormAction+"; base-uri 'none'; frame-ancestors 'none'")
 	if err := pageTemplate.Execute(w, p); err != nil {
 		log.Error().Err(err).Msg("could not render the consent page")
 	}

backend/internal/handler/oauthconsent/consent_test.go

@@ -92,6 +92,8 @@ func TestServeGet(t *testing.T) {
 			assert.Equal(t, "no-store", h.Get("Cache-Control"))
 			assert.Equal(t, "DENY", h.Get("X-Frame-Options"))
 			assert.Contains(t, h.Get("Content-Security-Policy"), "frame-ancestors 'none'")
+			// The POST redirects to the app; form-action must allow it.
+			assert.Contains(t, h.Get("Content-Security-Policy"), "form-action 'self' http://localhost:3118;")
 
 			body := w.Body.String()
 			assert.Contains(t, body, "Claude <b>Code</b>")
@@ -321,6 +323,19 @@ func TestDestination(t *testing.T) {
 	}
 }
 
+func TestFormActionSource(t *testing.T) {
+	for raw, want := range map[string]string{
+		"cursor://cb":                    "cursor:",
+		"http://localhost:3118/callback": "http://localhost:3118",
+		"http://127.0.0.1:9/cb":          "http:",
+		"http://[::1]:9/cb":              "http:",
+		"https://bücher.example/cb?x=1":  "https://xn--bcher-kva.example",
+		"https://app.com:8443/cb":        "https://app.com:8443",
+	} {
+		assert.Equal(t, want, formActionSource(raw), raw)
+	}
+}
+
 // errWriter fails every write, as a connection the client dropped does.
 type errWriter struct{ header http.Header }