From d60f89c9e2dd93a9aea6af6fb025b7b25c90de04 Mon Sep 17 00:00:00 2001 From: eleith Date: Fri, 30 Oct 2026 08:39:25 -0700 Subject: [PATCH] fix(web): allow Google consent form redirects Permit only accounts.google.com alongside self in form-action. Assert the exact delivered policy in the existing security-header case; retain existing consent redirect and nonce tests unchanged without adding browser interception infrastructure. --- .changeset/google-consent-form-policy.md | 5 +++++ apps/web/e2e/headers.e2e.ts | 3 +++ apps/web/vite.config.ts | 2 +- 3 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 .changeset/google-consent-form-policy.md diff --git a/.changeset/google-consent-form-policy.md b/.changeset/google-consent-form-policy.md new file mode 100644 index 00000000..f02b8a5c --- /dev/null +++ b/.changeset/google-consent-form-policy.md @@ -0,0 +1,5 @@ +--- +'@when/web': patch +--- + +Allow Google's consent origin in the form security policy so the admin calendar connection can redirect in Chromium. diff --git a/apps/web/e2e/headers.e2e.ts b/apps/web/e2e/headers.e2e.ts index aa12e111..04db04af 100644 --- a/apps/web/e2e/headers.e2e.ts +++ b/apps/web/e2e/headers.e2e.ts @@ -18,6 +18,9 @@ test('the booking page sends the security headers', async ({ request }) => { expect(headers['referrer-policy']).toBe('strict-origin-when-cross-origin'); expect(headers['x-content-type-options']).toBe('nosniff'); expect(headers['content-security-policy']).toContain("frame-ancestors 'none'"); + expect( + headers['content-security-policy'].split(';').map((directive) => directive.trim()) + ).toContain("form-action 'self' https://accounts.google.com"); }); test('booking forms check browser Origin against the same trusted scheme and Host', async ({ diff --git a/apps/web/vite.config.ts b/apps/web/vite.config.ts index 9c46d024..5941cd1d 100644 --- a/apps/web/vite.config.ts +++ b/apps/web/vite.config.ts @@ -36,7 +36,7 @@ export default defineConfig(({ command }) => { 'connect-src': ['self'], 'object-src': ['none'], 'base-uri': ['self'], - 'form-action': ['self'], + 'form-action': ['self', 'https://accounts.google.com'], 'frame-ancestors': ['none'] } } -- 2.54.0