From 490b9658b1f117aaa9e618986ac84ad89a905bea Mon Sep 17 00:00:00 2001
From: BenoitSerrano <benoit.serrano10@gmail.com>
Date: Tue, 17 Mar 2026 22:30:45 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20add=20test=20with=20sec?=
 =?UTF-8?q?urity=20response=20headers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 cypress/e2e/signup_from_standard_client/env.conf | 1 +
 src/index.ts                                     | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/cypress/e2e/signup_from_standard_client/env.conf b/cypress/e2e/signup_from_standard_client/env.conf
index e69de29bb..5605b60ce 100644
--- a/cypress/e2e/signup_from_standard_client/env.conf
+++ b/cypress/e2e/signup_from_standard_client/env.conf
@@ -0,0 +1 @@
+FEATURE_USE_SECURITY_RESPONSE_HEADERS=True
diff --git a/src/index.ts b/src/index.ts
index c861e1543..2ec5092ce 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -82,7 +82,7 @@ if (FEATURE_USE_SECURITY_RESPONSE_HEADERS) {
         // As for https://github.com/w3c/webappsec-csp/issues/8, the feature is debated
         // and seems not useful for open id provider redirection.
         // We bypass this security for now.
-        formAction: ["'self'", "*"],
+        formAction: ["'self'"],
       },
     };