„'cross-origin-resource-policy' is missing!” error in admin panel

[k-matti]

Vaultwarden Support String

After updating to the newest version I see that error in admin panel diagnostic tab

Vaultwarden Build Version

1.33.0

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

Nginx proxy manager

Host/Server Operating System

NAS/SAN

Operating System Version

Unraid

Clients

Web Vault

Client Version

No response

Steps To Reproduce

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. Click on '...'
5. Etc '...'

Expected Result

No error

Actual Result

Error

Logs

Screenshots or Videos

No response

Additional Context

No response

[Misabthepro]

Same error here too

[BlackDex]

That means that that specific header is not sent for some reason. Vaultwarden does sent this header, and then probably your reverse proxy or tunnel provider strips it somewhere.

[sroepges]

I use jc21/nginx-proxy-manager and this worked for me:

add_header Cross-Origin-Resource-Policy "same-origin";

[BlackDex]

That shouldn't be needed. You need to let Vaultwarden to send all the headers and not manipulate them.

[NoahDar]

I am seeing the same thing with HAProxy in Pfsense right after the upgrade today. I will try adding that header to HAProxy but general rule with Vaultwarden is not to add anything and let the server handle the headers. I will take a look at other stuffs before trying that.

[sroepges]

I removed the header from NPM and purged the browser cache, now it seems to work again without manually setting the header.

[NoahDar]

I've tried this on a different browser and now it's all green so it's definitely a caching issue in the browser not the server. I didn't have to add any headers to HAProxy so it's all good now. 👍

[YamenSharaf]

I'm seeing the same issue. Using Cloudflare Tunnel

[BlackDex]

Same for you then.
Something is blocking or removing that header.
Might be the reverse proxy, but could be the tunnel.

[YamenSharaf]

I didn't see this issue before updating to 1.33.0.

Likely something has changed with this update, rather than the issue being with nginx and CF tunnels, but I can't be sure. Is that a new check?

[BlackDex]

I can, it's a new check and added security header since 1.33.0.

See https://developers.cloudflare.com/cache/cache-security/cors/#add-or-change-cors-headers, i think purging the cache is then probably the way to go when using Cloudflare.

[YamenSharaf]

I did that and the check is now green. Thanks for your help!

[tessus]

@BlackDex nope, it's not a reverse proxy issue. I got the same error after upgrading to 1.33.0 from 1.32.7 (c0be36a).
I haven't changed my Apache reverse proxy setup in ages. The only thing that changed is vw.

The browser cache seems to be the problem, although I don't know why.

The way to fix this is: Cmd+Shift+R (in Firefox)

[NoseyNick]

Also Apache. Also Firefox... but real keyboard, so Ctrl+Shift+R for me 😜