title: Chrome Ignoring CSP Directive in the Header on a Redirect
body: <p>I am implementing an OpenID Connect client web application. After the user is successfully authenticated in the identity provider, they are redirected back over to my web application. Once they arrive, depending on the value of some query parameters they are redirected to a URL. When the redirection occurs Chrome throws this error in the console:</p>
  
  <p><code>Refused to send form data to 'https://my-domain-a.com/' because it violates the following Content Security Policy directive: "form-action 'self' https://my-domain-b.com/receive-token".</code></p>
  
  <p>After some googling I tried adding a <code>Content-Security-Policy</code> header as:</p>
  
  <p><code>content-security-policy: form-action 'self' https://my-domain-a.com</code></p>
  
  <p>This does not seem to have any affect and I still receive this message.</p>
  
  <p>I have 2 questions:</p>
  
  <ol>
  <li><p>How do I fix this?</p></li>
  <li><p>Why is Chrome throwing this error off of a <code>301</code> redirect?</p></li>
  </ol>