During a recent OWASP ZAP scan, a medium-risk configuration issue was identified in the HTTP Content-Security-Policy (CSP) for the FreeIPA WebUI.

The CSP fails to define the form-action directive, which is critical as it has no fallback to default-src. The CSP form-action directive restricts the URLs which can be used as the target of form submissions from a given context. Missing this directive is equivalent to allowing anything.

CWE: CWE-693: Protection Mechanism Failure

Recommendation:

• Add an explicit and restrictive form-action directive to the CSP, only allowing trusted endpoints.