diff --git a/cypress/e2e/signup_from_standard_client/env.conf b/cypress/e2e/signup_from_standard_client/env.conf
index e69de29bb..5605b60ce 100644
--- a/cypress/e2e/signup_from_standard_client/env.conf
+++ b/cypress/e2e/signup_from_standard_client/env.conf
@@ -0,0 +1 @@
+FEATURE_USE_SECURITY_RESPONSE_HEADERS=True
diff --git a/src/index.ts b/src/index.ts
index c861e1543..2ec5092ce 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -82,7 +82,7 @@ if (FEATURE_USE_SECURITY_RESPONSE_HEADERS) {
         // As for https://github.com/w3c/webappsec-csp/issues/8, the feature is debated
         // and seems not useful for open id provider redirection.
         // We bypass this security for now.
-        formAction: ["'self'", "*"],
+        formAction: ["'self'"],
       },
     };