diff --git a/app/Http/Middleware/SecureHeaders.php b/app/Http/Middleware/SecureHeaders.php
index 1e8a30fe37..90df83e700 100644
--- a/app/Http/Middleware/SecureHeaders.php
+++ b/app/Http/Middleware/SecureHeaders.php
@@ -54,12 +54,15 @@ class SecureHeaders
             sprintf("script-src 'self' 'unsafe-eval' 'unsafe-inline' %s", $google),
             "style-src 'self' 'unsafe-inline'",
             "base-uri 'self'",
-            "form-action 'self'",
             "font-src 'self'",
             "connect-src 'self'",
             "img-src 'self' data: https://api.tiles.mapbox.com",
             "manifest-src 'self'",
         ];
+        $route = $request->route()->uri;
+        if($route !== 'oauth/authorize') {
+            $csp[] = "form-action 'self'";
+        }
 
         $featurePolicies = [
             "geolocation 'none'",