# Using form hijacking to bypass CSP

DevFeed: [Using form hijacking to bypass CSP](<https://devfeed.tech/articles/using-form-hijacking-to-bypass-csp-7718.md>)

Original publisher: [Read original article](<https://portswigger.net/research/using-form-hijacking-to-bypass-csp>)

Author: Gareth Heyes

Published: 2024-03-05T14:55:00Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [HTML](<https://devfeed.tech/topics/html.md>), [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [Mastodon](<https://devfeed.tech/topics/mastodon.md>), [Google](<https://devfeed.tech/topics/google.md>)

Tags: [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [csp](<https://devfeed.tech/tags/csp.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [html](<https://devfeed.tech/tags/html.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [password](<https://devfeed.tech/tags/password.md>), [report](<https://devfeed.tech/tags/report.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

This article explains how form hijacking can bypass Content Security Policy when a site has an HTML injection vulnerability and fails to restrict form actions. Injected forms or form-action attributes can send credentials to an attacker, with password managers potentially autofilling the fields. It discusses real-world examples, CSP configuration mistakes, and Burp passive scan checks for related issues.

## Source excerpt

In this post we'll show you how to bypass CSP by using an often overlooked technique that can enable password theft in a seemingly secure configuration. What is form hijacking? Form hijacking isn't re