Document Chrome form-action behavior (#8764)

* Document Chrome form-action behavior

* Update content/doc/developer/security/csp.adoc

Co-authored-by: Kevin Guerroudj <91883215+Kevin-CB@users.noreply.github.com>

---------

Co-authored-by: Daniel Beck <daniel-beck@users.noreply.github.com>
Co-authored-by: Kevin Guerroudj <91883215+Kevin-CB@users.noreply.github.com>

Author: daniel-beck

content/doc/developer/security/csp.adoc

@@ -44,6 +44,9 @@ This header is used to return JavaScript code to be executed on the client side.
 Resources loaded from other domains::
 Any images, scripts, styles, etc. loaded from other domains cause problems.
 Resources should be hosted by Jenkins.
+Redirecting to a different domain in response to a form submission::
+Google Chrome refuses to be redirected using HTTP 3xx responses based on the `form-action` CSP directive.
+A relatively common example of this is some administrative monitors, which handle a form submission for a "Learn more" (or similarly labeled) button by redirecting users to documentation on jenkins.io.
 
 
 == Dynamically Identifying Plugins
@@ -231,6 +234,15 @@ Any dynamically determined images (e.g., "avatar" images based on user configura
   In this case, make sure that only administrators can ultimately configure the domains that images can be loaded from.
   For example, regular Jenkins users should not be able to, e.g., edit their user profile or configure a job in a certain way to allow a domain of their choice.
 
+=== Redirecting to a different domain in response to a form submission
+
+Jenkins 2.TODO introduces the `ClientHttpRedirect` and `HttpResponses#clientRedirectTo` APIs to perform client-side redirects after form submissions, which bypasses Google Chrome's CSP restrictions.
+Use these instead of `HttpRedirect` or `HttpResponses#redirectTo`.
+
+Alternatively, you can switch from `f:submit` or a `button` to a link, which can be made to look like a button: `<a class="jenkins-button">` (optionally other classes adding the correct primary/secondary/tertiary style).
+This does not require updating your Jenkins core dependency to 2.TODO.
+Another benefit of links is that you can set them up to always open in a new window with `target="_blank" rel="noopener noreferrer"`, preventing accidental navigation away from Jenkins on the current view.
+
 == Testing
 
 === In Jenkins 2.539 and newer