The baseline policy: it sets no default-src, script-src or style-src, so core's inline
script and style keep working, and it carries no form-action. A form that posts to a page and
redirects to another origin (a login button that sends the visitor to an identity provider) is
blocked by form-action 'self' in Chromium, and no site can be checked here for one.
The baseline policy: it sets no
default-src,script-srcorstyle-src, so core's inline script and style keep working, and it carries noform-action. A form that posts to a page and redirects to another origin (a login button that sends the visitor to an identity provider) is blocked byform-action 'self'in Chromium, and no site can be checked here for one.