Got an issue about Content Security Policy directive "form-action 'none'" after login with root token

[namthuoc-LE]

Describe the bug An error occurred in browser console when submitting the login with root token Refused to send form data to '[http://172.18.4.33:8200/ui/vault/auth?token=hvs.yBf3dfgOninntAafjEr9ogR0'](http://172.18.4.33:8200/ui/vault/auth?token=hvs.yBf3dfgOninntAafjEr9ogR0%27) because it violates the following Content Security Policy directive: "form-action 'none'".

To Reproduce Steps to reproduce the behavior:

1. Go to Vault UI
2. Log in with root token
3. Open console log on development tools

Expected behavior This error should not be occurred.

Environment:

• Microsoft Edge Version 108.0.1462.54 (Official build) (64-bit)
• Vault status

  / $ vault status
  Key                      Value
  ---                      -----
  Recovery Seal Type       shamir
  Initialized              true
  Sealed                   false
  Total Recovery Shares    3
  Threshold                3
  Version                  1.12.2
  Build Date               2022-11-23T12:53:46Z
  Storage Type             postgresql
  Cluster Name             vault-cluster-3dcdbeff
  Cluster ID               fb0f4069-5104-337f-8792-6bbc9e526272
  HA Enabled               true
  HA Cluster               https://vault-0.vault-internal:8201
  HA Mode                  active
  Active Since             2023-01-05T07:22:06.630424011Z

[sabarisankarj]

I am observing similar issue in Vault versions 1.11.5 and 1.11.6, login with root token is working only with 1.11.4.

[liboyang0615]

I am having the same issue with Vault v1.12.1 (e34f8a14fb7a88af4640b09f3ddbb5646b946d9c), built 2022-10-27T12:32:05Z

Here is the UI error with chrome

Uncaught TypeError: crypto.randomUUID is not a function at e.doSubmit (vault-7ab3e497103406a64edb22cafc68d75e.js:524:119) at B._run (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3395:94) at B._join (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3394:234) at B.join (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3360:13) at f (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:2075:63) at vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:231:75 at a (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:1979:139) at vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:231:30 at HTMLFormElement. (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:225:77) doSubmit @ vault-7ab3e497103406a64edb22cafc68d75e.js:524 _run @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3395 _join @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3394 join @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3360 f @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:2075 (anonymous) @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:231 a @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:1979 (anonymous) @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:231 (anonymous) @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:225 auth:1 Refused to send form data to 'http://xxxxxxx:xxxxx/ui/vault/auth?username=&password=' because it violates the following Content Security Policy directive: "form-action 'none'".

[hellobontempo]

Hi there! Thank you for reporting this 😄 I have a suspicion this started happening when we added crypto.randomUUID() which requires secure context.

Are you able to access the UI using https instead of http ?

[hellobontempo]

I am having the same issue with Vault v1.12.1 (e34f8a1), built 2022-10-27T12:32:05Z

Here is the UI error with chrome

Uncaught TypeError: crypto.randomUUID is not a function at e.doSubmit (vault-7ab3e497103406a64edb22cafc68d75e.js:524:119) at B._run (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3395:94) at B._join (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3394:234) at B.join (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3360:13) at f (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:2075:63) at vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:231:75 at a (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:1979:139) at vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:231:30 at HTMLFormElement. (vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:225:77) doSubmit @ vault-7ab3e497103406a64edb22cafc68d75e.js:524 _run @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3395 _join @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3394 join @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:3360 f @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:2075 (anonymous) @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:231 a @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:1979 (anonymous) @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:231 (anonymous) @ vendor-9435df1547cf2481cbe0bbe5b0f8c613.js:225 auth:1 Refused to send form data to 'http://xxxxxxx:xxxxx/ui/vault/auth?username=&password=' because it violates the following Content Security Policy directive: "form-action 'none'".

this is fixed by #19410

[zofskeez]

The crypto issue may be unrelated (and now fixed) from the original report. Since 1.11 is no longer maintained, is this still observable in > 1.12 @namthuoc-LE or @sabarisankarj? I tested logging in with the root token on 1.14 over http and am not seeing any errors.

[sabarisankarj]

This issue is resolved after upgrade to 1.12.4. Thanks for the follow up.