Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Form action set as insecure by google chrome. #349

Closed
AlbertSabate opened this issue Jan 4, 2024 · 2 comments
Closed

Form action set as insecure by google chrome. #349

AlbertSabate opened this issue Jan 4, 2024 · 2 comments

Comments

@AlbertSabate
Copy link
Contributor

Describe the bug

When accessing a website with https, the forms action="" that are not https:// are set as insecure by Google Chrome Google Chrome Docs.

The new form action on @solidjs/router renders the markup like this:

<form method="post" action="action:signUpForm">...</form>

Google Chrome sets it as insecure, as shown in the image below.
Screenshot 2024-01-04 at 11 04 24 PM

Your Example Website or App

https://start.solidjs.com/core-concepts/actions#using-forms-to-submit-data

Steps to Reproduce the Bug or Issue

Create a form using the example on the solidjs/start a website.
Open the site using https.
Click on any input, and the message will show.

Expected behavior

The form should not be set as insecure as it could generate distrust from the users.

Screenshots or Videos

No response

Platform

Google Chrome.

Additional context

No response

AlbertSabate added a commit to AlbertSabate/solid-router that referenced this issue Jan 4, 2024
AlbertSabate added a commit to AlbertSabate/solid-router that referenced this issue Jan 4, 2024
@AlbertSabate
Copy link
Contributor Author

AlbertSabate commented Jan 4, 2024

Okay, I've tested changing action for https://action, and Google Chrome is blocking the request.
I needed to use a valid domain format so the colon would not be allowed unless followed by numbers.
I changed it to https://action--. The redirect is working fine, but the handleFormSubmit cannot evt.preventDefault(), and the action post is being triggered into a broken page.
Improving the format further and replacing -- for / is working fine, and the event can be default prevented.

Current working format https://action/${eventName}

@ryansolid
Copy link
Member

Alright 0.10.7 is released

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants