I have created a very simple test plugin here. The web extension displays a browser action button which, when clicked, creates a new window with a simple form and submit button. Clicking on the submit button should send a POST request but when used from within the temporary profile launched using web-ext
it always seems to send a GET instead.
I did some further digging into the form-action
directive of CSP and if this were what was causing it, the prescribed behavior according to the W3C CSP 2 spec is to act like a fatal network error occurred. Since the browser instead seems to arbitrarily decide to switch the POST to GET, it doesn’t seem CSP related, at least not the form-action
.