add support for response_mode=form_post

backend/internal/controller/oidc_controller.go

@@ -94,6 +94,11 @@ func (oc *OidcController) authorizeHandler(c *gin.Context) {
 		return
 	}
 
+	// Set the allowed form-action in CSP when response_mode is form_post
+	if input.ResponseMode == "form_post" && input.CallbackURL != "" {
+		middleware.SetAllowedFormAction(c, input.CallbackURL)
+	}
+
 	code, callbackURL, err := oc.oidcService.Authorize(c.Request.Context(), input, c.GetString("userID"), c.ClientIP(), c.Request.UserAgent())
 	if err != nil {
 		_ = c.Error(err)