.changeset/google-consent-form-policy.md

@@ -0,0 +1,5 @@
+---
+'@when/web': patch
+---
+
+Allow Google's consent origin in the form security policy so the admin calendar connection can redirect in Chromium.

apps/web/e2e/headers.e2e.ts

@@ -18,6 +18,9 @@ test('the booking page sends the security headers', async ({ request }) => {
 	expect(headers['referrer-policy']).toBe('strict-origin-when-cross-origin');
 	expect(headers['x-content-type-options']).toBe('nosniff');
 	expect(headers['content-security-policy']).toContain("frame-ancestors 'none'");
+	expect(
+		headers['content-security-policy'].split(';').map((directive) => directive.trim())
+	).toContain("form-action 'self' https://accounts.google.com");
 });
 
 test('booking forms check browser Origin against the same trusted scheme and Host', async ({

apps/web/vite.config.ts

@@ -36,7 +36,7 @@ export default defineConfig(({ command }) => {
 						'connect-src': ['self'],
 						'object-src': ['none'],
 						'base-uri': ['self'],
-						'form-action': ['self'],
+						'form-action': ['self', 'https://accounts.google.com'],
 						'frame-ancestors': ['none']
 					}
 				}