Refused to send form data to 'https://example.com/customer/account/logout/'
because it violates the following Content Security Policy directive: "form-action 
'self' secure.authorize.net test.authorize.net pilot-payflowlink.paypal.com 
www.paypal.com www.sandbox.paypal.com *.facebook.com ".

I really don't understand that I have added 'https://example.com/' into csp_whitelist by form-action. But it still does not work.

2 Answers 2


I figured it out by myself. Post it here if anyone needs in future:

When user click logout button, we will send a form to https://example.com/customer/account/logout/'. Due to the same domain, that is why error mentioned it is form-action 'self'.

But after it, the page redirects to another url, which is not visible in the CSP report.

The reason why the target url of the redirect is not visible in the CSP report (which is really confusing) is a security issue, see https://w3c.github.io/webappsec-csp/#create-violation-for-request, it would otherwise be possible to analyse the behaviour of form endpoints.

The solution: I added the redirect endpoint url into 'form-action' CSP.


Can you please try once with wildcard in form-action

enter image description here

  • I tried, it does not work. Commented Dec 21, 2022 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.