Unrecognized Content-Security-Policy directive 'prefetch-src'.

[ramesh8830]

Deployed the server in production environment with metallb load balancer. But having issues with CORS.

Below are my CSP headers in webapp values.yaml

CSP_EXTRA_CONNECT_SRC: "https://*.example.com, wss://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_IMG_SRC: "https://*.example.com, wss://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_SCRIPT_SRC: "https://*.example.com, wss://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_DEFAULT_SRC: "https://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_FONT_SRC: "https://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_FRAME_SRC: "https://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_MANIFEST_SRC: "https://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_OBJECT_SRC: "https://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_MEDIA_SRC: "https://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_PREFETCH_SRC: "https://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_STYLE_SRC: "https://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"
CSP_EXTRA_WORKER_SRC: "https://*.example.com, https://*.giphy.com, https://s3.us-east-1.amazonaws.com"

CORS Errors on the browser console

Unrecognized Content-Security-Policy directive 'prefetch-src'.

Access to XMLHttpRequest at 'https://api.example.com/api-version' from origin 'https://app.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
GET https://api.example.com/api-version net::ERR_FAILED 200

Kubernetes Version

:~# kubectl version
Client Version: version.Info{Major:"1", Minor:"19", GitVersion:"v1.19.7", GitCommit:"1dd5338295409edcfff11505e7bb246f0d325d15", GitTreeState:"clean", BuildDate:"2021-01-13T13:23:52Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"19", GitVersion:"v1.19.7", GitCommit:"1dd5338295409edcfff11505e7bb246f0d325d15", GitTreeState:"clean", BuildDate:"2021-01-13T13:15:20Z", GoVersion:"go1.15.5", Compiler:"gc", Platform:"linux/amd64"}

Wire Webapp Image used

image:
  repository: quay.io/wire/webapp
  tag: "2023-04-11-production.0-v0.31.13-0-bb91157"

Please help me fix the CORS issue.

[supersven]

@ramesh8830 The Access-Control-Allow-Origin header is set by nginz (and cannon's nginx in some special cases.)

Could you please check these Values:

• nginz.nginx_conf.allowlisted_origins
• nginz.nginx_conf.nginx_conf.external_env_domain

[ramesh8830]

@supersven I am sorry, I am new to kubernetes and this wire server deployment.

Please guide me how to and where to check these values.

[supersven]

@ramesh8830 You should have some yaml file or files where you put all config values. The dots (.) refer to nodes in this yaml file.

E.g. Link to nginz.nginx_conf.nginx_conf.external_env_domain if you are using the demo setup values.

I think you need to set:

• allowlisted_origins: app (as your webapp is served there)
• external_env_domain: example.com (as this is your domain)

This should give you Access-Control-Allow-Origin headers, when a requests origin is https://app.example.com.

Hope this helps 😃

[ramesh8830]

allowlisted_origins: app (as your webapp is served there) added this to the values.yaml files but getting below error when deployed.

nginz:
  replicaCount: 3
  config:
    ws:
      useProxyProtocol: false
#  images:
#    nginz:
#      tag: some-tag (only override if you want a newer/different version than what is in the chart)
  nginx_conf:
    # using prod means mostly that some internal endpoints are not exposed
    env: prod
    allowlisted_origins: app
    external_env_domain: example.com
    deeplink:
      endpoints:
        backendURL: "https://api.example.com"
        backendWSURL: "https://wss.example.com"
        teamsURL: "https://teams.example.com"
        accountsURL: "https://account.example.com"
        blackListURL: "https://clientblacklist.example.com/prod"
        websiteURL: "https://example.com"
      title: "My Custom example Backend"

bash-5.1# helm upgrade --install --namespace production wire-server wire/wire-server -f values/wire-server/values.yaml -f values/wire-server/secrets.yaml --wait
Error: UPGRADE FAILED: template: wire-server/charts/nginz/templates/deployment.yaml:27:31: executing "wire-server/charts/nginz/templates/deployment.yaml" at <include (print .Template.BasePath "/configmap.yaml") .>: error calling include: template: wire-server/charts/nginz/templates/configmap.yaml:4:4: executing "wire-server/charts/nginz/templates/configmap.yaml" at <include "nginz_nginx.conf" .>: error calling include: template: wire-server/charts/nginz/templates/conf/_nginx.conf.tpl:131:31: executing "nginz_nginx.conf" at <.Values.nginx_conf.allowlisted_origins>: range can't iterate over app

[supersven]

Ah, sorry, it's a list in yaml. E.g.

nginz:
  replicaCount: 3
  config:
    ws:
      useProxyProtocol: false
#  images:
#    nginz:
#      tag: some-tag (only override if you want a newer/different version than what is in the chart)
  nginx_conf:
    # using prod means mostly that some internal endpoints are not exposed
    env: prod
    allowlisted_origins: 
      - app
...

The default values.yaml file of the Helm chart provides some documentation: https://github.com/wireapp/wire-server/blob/develop/charts/nginz/values.yaml#L71

[ramesh8830]

@supersven It worked. Thank you so much for your help

Have a great day ahead.

[supersven]

@ramesh8830 Welcome 😄

BTW, there are more web application you may want to use (e.g. account-pages.) If you run into the same issue with one of them, you'll have to add them to the same list.

May I close this ticket?

[ramesh8830]

Yeah. I have used the app, teams and account in there. but I am not getting Pro account creation like we have in the older version.

Old version like below and able to create Pro accounts.

Please let me know if you have any idea about how to activate that.

[supersven]

According to @julialongtin this is only a change in the label.

[ramesh8830]

In the old version of wire, url for pro account is https://app.exacmple.com/auth/#createteam

But in the new version it is redirecting to https://teams.example.com/register/email which lead me to 404 error

[ramesh8830]

unable to send connection request. getting below error.

Request URL:
https://api.example.com/v3/connections/example.com/55cdabbf-720e-4b2b-878a-ca2a974e4bca
Request Method:
POST
Status Code:
500
Remote Address:
external_ip:443
Referrer Policy:
same-origin
Access-Control-Allow-Origin:
https://app.example.com
Access-Control-Expose-Headers:
Request-Id, Location
Content-Encoding:
gzip
Content-Type:
application/json
Date:
Wed, 28 Jun 2023 19:54:53 GMT
Request-Id:
9957b8036d02b7955c3e2e8c0d0d3906
Strict-Transport-Security:
max-age=15724800; includeSubDomains
Vary:
Accept-Encoding
:Authority:
api.example.com
:Method:
POST
:Path:
/v3/connections/example.com/55cdabbf-720e-4b2b-878a-ca2a974e4bca
:Scheme:
https
Accept:
application/json, text/plain, */*
Accept-Encoding:
gzip, deflate, br
Accept-Language:
en-US,en;q=0.9,cy;q=0.8
Authorization:
Bearer CEevU7mqc3SMH-XhmxqM8zCfZ2MHF0uhSCkpFEgeNJGaeG_F-SGIGdLAlrvrnQLtzwWWvcORd-8o10VvNWF3Aw==.v=1.k=1.d=1687982745.t=a.l=.u=34d4acb7-dc58-4263-a802-58877e60dfc6.i=5d16c30a1c40226d.c=18361318061627808208
Content-Length:
0
Origin:
https://app.example.com
Sec-Ch-Ua:
"Not.A/Brand";v="8", "Chromium";v="114", "Microsoft Edge";v="114"
Sec-Ch-Ua-Mobile:
?0
Sec-Ch-Ua-Platform:
"Windows"
Sec-Fetch-Dest:
empty
Sec-Fetch-Mode:
cors
Sec-Fetch-Site:
same-site
User-Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.58

[ramesh8830]

Please help me on the above. I did not enable federation and legalhold

[akshaymankar]

I haven't tested this, but I think you can set this environment variable in the webapp helm chart to restore the previous behaviour:

URL_TEAMS_CREATE:  https://app.example.com/auth/#createteam

[ramesh8830]

unable to send connection request. getting below error.

Request URL:
https://api.example.com/v3/connections/example.com/55cdabbf-720e-4b2b-878a-ca2a974e4bca
Request Method:
POST
Status Code:
500
Remote Address:
external_ip:443
Referrer Policy:
same-origin
Access-Control-Allow-Origin:
https://app.example.com
Access-Control-Expose-Headers:
Request-Id, Location
Content-Encoding:
gzip
Content-Type:
application/json
Date:
Wed, 28 Jun 2023 19:54:53 GMT
Request-Id:
9957b8036d02b7955c3e2e8c0d0d3906
Strict-Transport-Security:
max-age=15724800; includeSubDomains
Vary:
Accept-Encoding
:Authority:
api.example.com
:Method:
POST
:Path:
/v3/connections/example.com/55cdabbf-720e-4b2b-878a-ca2a974e4bca
:Scheme:
https
Accept:
application/json, text/plain, */*
Accept-Encoding:
gzip, deflate, br
Accept-Language:
en-US,en;q=0.9,cy;q=0.8
Authorization:
Bearer CEevU7mqc3SMH-XhmxqM8zCfZ2MHF0uhSCkpFEgeNJGaeG_F-SGIGdLAlrvrnQLtzwWWvcORd-8o10VvNWF3Aw==.v=1.k=1.d=1687982745.t=a.l=.u=34d4acb7-dc58-4263-a802-58877e60dfc6.i=5d16c30a1c40226d.c=18361318061627808208
Content-Length:
0
Origin:
https://app.example.com
Sec-Ch-Ua:
"Not.A/Brand";v="8", "Chromium";v="114", "Microsoft Edge";v="114"
Sec-Ch-Ua-Mobile:
?0
Sec-Ch-Ua-Platform:
"Windows"
Sec-Fetch-Dest:
empty
Sec-Fetch-Mode:
cors
Sec-Fetch-Site:
same-site
User-Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.58

@akshaymankar any idea about this issue. I am unable to send request to any person. When I click on the connect button, I am getting above error in the network and console of browser.

Please let me know

[akshaymankar]

I think only logs from brig can tell us why it is throwing a 500.