Fix: form-action CSP blocked atproto login form submission (v0.4.2) (#107)

* Fix: drop form-action CSP that blocked the atproto handle form submit

The handle-entry form sets a strict CSP. The `form-action 'self'` directive
(added for defense-in-depth) silently broke login: submitting the form hits
our endpoint, which immediately 302-redirects to the user's own
authorization server (any PDS, cross-origin). `form-action` is enforced
across the entire redirect chain, so `'self'` blocks the submission and the
browser does nothing — exactly the "form doesn't send me there" symptom,
while navigating to the auth URL directly worked (no form-action involved).

Remove the `form-action` directive entirely — it is fundamentally
incompatible with a login form that must redirect to per-user auth servers.
The rest of the hardening (default-src 'none', no scripts, frame-ancestors,
nosniff, no-store, style-src 'self') stays. Add a regression test asserting
the form CSP never carries form-action.

Reproduced and verified the fix by driving the form in headless Chrome.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Release v0.4.2

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: sergeychernyshev

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@startup-api/cloudflare",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "license": "Apache-2.0",
   "publishConfig": {
     "access": "public"

package.json

@@ -304,10 +304,12 @@ export class AtprotoProvider extends OAuthProvider {
       status,
       headers: {
         'Content-Type': 'text/html; charset=utf-8',
-        // Same hardening as the auth error page: only same-origin styles/form, never framed, never cached
-        // (the re-rendered form reflects the user-supplied handle).
-        'Content-Security-Policy':
-          "default-src 'none'; style-src 'self' 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+        // Hardening: same-origin styles only, never framed, never cached (the form reflects the
+        // user-supplied handle). NOTE: deliberately NO `form-action` directive — submitting this form
+        // hits our endpoint, which 302-redirects to the user's *own* authorization server (any PDS).
+        // `form-action` is enforced across the whole redirect chain, so `'self'` (or any fixed list)
+        // would block that cross-origin redirect and the login would silently fail.
+        'Content-Security-Policy': "default-src 'none'; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'",
         'X-Content-Type-Options': 'nosniff',
         'Referrer-Policy': 'no-referrer',
         'Cache-Control': 'no-store',

src/auth/AtprotoProvider.ts

@@ -101,6 +101,9 @@ describe('atproto provider', () => {
     // Auth page hardening: not framable, not cached (it can reflect the user's handle).
     expect(res.headers.get('Content-Security-Policy')).toContain("frame-ancestors 'none'");
     expect(res.headers.get('Cache-Control')).toBe('no-store');
+    // Must NOT set form-action: submitting this form 302-redirects to the user's own auth server
+    // (any PDS), and form-action is enforced across the redirect chain — restricting it breaks login.
+    expect(res.headers.get('Content-Security-Policy')).not.toContain('form-action');
     const html = await res.text();
     expect(html).toContain('name="handle"');
   });