From a0ef38dcc76f1a7d65cd6afbeeb25b192dc6abe5 Mon Sep 17 00:00:00 2001
From: Andrew Harvard <aharvard@squareup.com>
Date: Thu, 5 Feb 2026 09:30:09 -0500
Subject: [PATCH] Add allow-forms to sandbox attribute for form support

---
 crates/goose-server/src/routes/templates/mcp_app_proxy.html | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/goose-server/src/routes/templates/mcp_app_proxy.html b/crates/goose-server/src/routes/templates/mcp_app_proxy.html
index 0e3fdff158..09224c02af 100644
--- a/crates/goose-server/src/routes/templates/mcp_app_proxy.html
+++ b/crates/goose-server/src/routes/templates/mcp_app_proxy.html
@@ -32,7 +32,8 @@
           // Sandbox restricts the iframe's capabilities
           // allow-scripts: Let JS run
           // allow-same-origin: Required for postMessage to work properly
-          guestIframe.setAttribute('sandbox', 'allow-scripts allow-same-origin');
+          // allow-forms: Needed if the app has forms
+          guestIframe.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-forms');
           
           // Build Permission Policy allow attribute from requested permissions
           var allowList = [];