Forge serves all app iframe resources with default Content-Security-Policy response header that includes form-action 'self'. This blocks native HTML <form> submissions to any external URL inside a Forge Custom UI app even when wildcard fetch permission is declared in manifest.
Is form-action 'self' intentional for Forge Custom UI apps, and if so, what is the security rationale given that CSP connect-src * is already allowed?
Current workaround is intercepting the submit event in JavaScript and re-submitting via fetch(), but this is a workaround rather than a proper solution.