OPNsense Forum

English Forums => General Discussion => Topic started by: MichaDebuss on February 09, 2025, 09:29:57 AM

Title: Vaultwarden error message NGINX: Header 'cross-origin-resource-policy' missing!
Post by: MichaDebuss on February 09, 2025, 09:29:57 AM
Hello everyone,

I have a self-hosted Vaultwarden instance. After an update, its diagnostics display the following error message:

HTTP Response validation Error
2FA Connector calls:
Header: 'cross-origin-resource-policy' is missing!

On my OPNsense (25.1) system, I'm running the NGINX Plugin (version 1.34_6) as a reverse proxy.
What do I need to configure to eliminate this error message?

I appreciate any suggestions or help.

Best regards,
Michael

(https://i.postimg.cc/Y9Q1VFD1/Bildschirmfoto-2025-02-08-um-14-59-33.png) (https://postimages.org/)

Title: Re: Vaultwarden error message NGINX: Header 'cross-origin-resource-policy' missing!
Post by: RamSense on February 09, 2025, 12:40:42 PM
Hi Michael,

Running Vaultwarden local here also. Although I have (other) problems with Nginx since Opnsense 25.1 (see https://forum.opnsense.org/index.php?topic=45602.0 (https://forum.opnsense.org/index.php?topic=45602.0))
Vaultwarden runs as it should. HTTP Response validation OK

Do you have the domain set in vaultwarden: general settings - Domain URL ?

or at opnsense - nginx - http server - Security Header -> do you have a security header set?
Remove this and see if it works, if yes, you have to change your security headers.
Title: Re: Vaultwarden error message NGINX: Header 'cross-origin-resource-policy' missing!
Post by: MichaDebuss on February 09, 2025, 04:18:33 PM
Hi RamSense,

thank you for your reply.

The domain URL is set in the Vaultwarden general settings and there is no security headers in nginx http server set.


(https://i.postimg.cc/Wzxxj3Bm/SEC-HEADER.png) (https://postimg.cc/n9Y3GHcM)


Any further ideas?

Best regards,

Micha
Title: Re: Vaultwarden error message NGINX: Header 'cross-origin-resource-policy' missing!
Post by: RamSense on February 09, 2025, 04:24:03 PM
I have HTTP Server - HTTP Listen Address empty (removed 80, [::]:80)

And I see you have : Advanced ACL Authentication Backend
you could remove that to test if that is blocking (you)
Title: Re: Vaultwarden error message NGINX: Header 'cross-origin-resource-policy' missing!
Post by: MichaDebuss on February 09, 2025, 04:52:31 PM
Yes!

Thank you so much RamSense. It's working now.

Best regards,

Micha
Title: Re: Vaultwarden error message NGINX: Header 'cross-origin-resource-policy' missing!
Post by: RamSense on February 09, 2025, 05:01:36 PM
Good to hear!