Directive: form action

Overview

The form-action directive restricts the URLs which can be used as the target of form submissions via <form action>.

Affects: <form action>

Required reading:

• Can I use form-action?
• MDN Web Docs reference

Usage examples

Accepts one or more schemes or hosts, the 'self' keyword, or the 'none' keyword.

form-action 'none'

form-action 'self'

form-action example.com

form-action example.com example.org

form-action https://*.example.com

form-action https:

Fallbacks

❌ form-action does not fallback to default-src.

Possible errors

• CSP-0100 — [ERROR] directive %s has an invalid value %s

For developers

ABNF (CSP3)

directive-name  = "form-action"
directive-value = serialized-source-list

See ABNF: serialized-source-list

Type

• source-list in CSP2
• serialized-source-list in CSP3

References

• CSP Level 2 reference
• CSP Level 3 reference
• MDN Web Docs reference
• Can I use form-action?