lyra
e2780ca5f6
When subdomain redirection is off, the login form is served inline on the protected host and submission happens via a same-origin fetch() call in _script.html.twig. The CSP default-src 'none' was blocking that fetch (connect-src falls back to default-src). Add connect-src 'self' to the CSP only when the request is not on the auth subdomain (i.e. when the inline script is present). On the auth subdomain the form POSTs normally with no inline script, so the stricter policy still applies there. This is the least-privilege relaxation: only same-origin connections, only on pages that need them.