Allow registered provider redirects after sign-out confirmation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

src/internal/server/oidc/account.go

@@ -49,7 +49,11 @@ func (h *AccountLogoutHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
 	w.Header().Set("Cache-Control", "no-store")
 	// Keep the same-origin POST Origin; no-referrer makes Chromium send Origin: null.
 	w.Header().Set("Referrer-Policy", "same-origin")
-	w.Header().Set("Content-Security-Policy", "default-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'")
+	// Chromium applies form-action to the POST redirect chain as well.
+	upstream, _ := url.Parse(h.UpstreamLogoutURL)
+	portal, _ := url.Parse(h.PortalURL)
+	destinations := upstream.Scheme + "://" + upstream.Host + " " + portal.Scheme + "://" + portal.Host
+	w.Header().Set("Content-Security-Policy", "default-src 'none'; form-action 'self' "+destinations+"; frame-ancestors 'none'; base-uri 'none'")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
 	switch r.Method {
 	case http.MethodGet:

src/internal/server/oidc/account_test.go

@@ -34,6 +34,9 @@ func TestSharedLogoutRequiresConfirmationAndFixedReturn(t *testing.T) {
 	if w.Header().Get("Referrer-Policy") != "same-origin" {
 		t.Fatal("browser POST would lose its Origin")
 	}
+	if !strings.Contains(w.Header().Get("Content-Security-Policy"), "form-action 'self' https://auth.example https://users.example;") {
+		t.Fatal("browser must follow registered sign-out destinations")
+	}
 	c := w.Result().Cookies()[0]
 	if !c.Secure || !c.HttpOnly || c.Domain != "" {
 		t.Fatal("unsafe CSRF cookie")