mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André Bombeck
864566d882
After Allow on the MCP OAuth consent screen, Chromium-based browsers stayed on the page although the grant was issued. The page carried the app-wide CSP form-action 'self', and Chromium applies form-action to the redirect that follows the form post to the client's redirect_uri. The authorize route now owns the CSP of its responses and the proxy leaves that exact path alone. The consent page allows form-action for its own origin plus the origin of the redirect URI the route has just validated against the resolved client, and only https or http origins qualify. Every other response from the route keeps form-action 'self' with default-src 'none'. The redirect after the decision is now 303, which tells every browser to follow a form POST with a GET. Refs #983