Require Form Action

ID

html.form_action_required

Severity

low

Remediation Complexity

low

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Html

Tags

reliability

Description

Flags a <form> element that lacks a non-blank action attribute.

Rationale

Without an explicit action, the form submits back to the current document URL. That is rarely the intent and usually signals a forgotten or mis-edited endpoint. Declaring the target explicitly keeps submission behaviour predictable and easy to review.

<form method="post">                  <!-- FLAW — no action -->
  ...
</form>

<form action="/submit" method="post"> <!-- OK — explicit target -->
  ...
</form>

Remediation

Add an action attribute pointing at the endpoint that should receive the submission, e.g. <form action="/submit" method="post">.

References