Cloudflare strips external domains from form action attribute?

Hey guys, I am running into a problem with HTML forms.

For a form action with an external link: <form method="POST" action="https://buttondown.email/api/emails/">
In production the action is being stripped and transforms into the following: <form method="POST">

I have tested my static site locally and it maintains the action but in Cloudflare Page it strips it.

Is there a configuration setting in Cloudflare that is stripping this form action and if so how do I disable it?

Pages doesn’t modify HTML by itself and I’m not aware of a Cloudflare feature that does this either.

When you tested locally, did you test in a dev server or a production build? If the former, try the latter and see if it happens there.

Hey Walshy, thanks for the response. I tried to build the production locally with my hugo project and even changed the server to build a dev build. It strips out the form action no matter what I do, with both an external form action or relative path form action.

I also tested with a proxy server with wrangler locally in front of my hugo server with the following command npx wrangler pages dev -- hugo server, I took a screenshot to show that even a relative path inside action it strips the form action.

If I put the URL in any other attribute for example data-url="http://..." it works fine, as soon as I add an form action strips it away.

Hugo server with default locahost:1313

@WalshyMVP thanks for your suggested help, I am willing to give any further information, I want to publish this website but need to work out why the form action fails to shows. Any ideas?

Here is the other screenshot:

Wrangler proxy in front of hugo server on localhost:8788

@WalshyMVP Hey Walshy, I resolved the problem, I kept stripping out things from the project and remembered I was using the Cloudflare plugin called @cloudflare/pages-plugin-static-forms

As seen in the GitHub .ts file (link at the end of the paragraph) for EVERY form it strips out the action. I did not realise it stripped out the action. I will raise an issue to detail this problem to target only forms that have the cloudflare static attribute. I am sure this would break other people’s websites, not just mine. Here is a link to the source code for others that wanted to read the plugins code themselves: https://github.com/cloudflare/pages-plugins/blob/main/packages/static-forms/functions/_middleware.ts

I hope my painful discovery will help anyone else resolve this issue in the future. Thank you very much Walshy for the help, I appreciate your time and suggestions, top bloke!!

2 Likes

Issue was actually raised here around 3 weeks ago by someone else https://github.com/cloudflare/pages-plugins/issues/39

Opened a pull request to fix this issue: https://github.com/cloudflare/pages-plugins/pull/41

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.