I was checking the spec for the form-action
directive and found the current description for the pre-navigation check appears to be mixed with the text for frame-ancestors
. See https://w3c.github.io/webappsec-csp/#form-action-pre-navigate
this algorithm returns "Blocked" if one or more of the ancestors of target violate the frame-ancestors directive delivered with the response, and "Allowed" otherwise