Refused to connect to 'http://.../remote.php/dav/' because it violates the following Content Security Policy directive: "connect-src 'self'"

Support intro

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version (eg, 12.0.2): 15.0.2
Operating system and version (eg, Ubuntu 17.04): ubuntu 18.04
Apache or nginx version (eg, Apache 2.4.25): apache 2.4.29
PHP version (eg, 7.1): 7.2.10

The issue you are facing:
/settings/admin/overview page shows

  • Dein Web-Server ist nicht richtig eingerichtet um “/.well-known/caldav” aufzulösen. Weitere Informationen findest Du in der Dokumentation.
  • Dein Web-Server ist nicht richtig eingerichtet um “/.well-known/carddav” aufzulösen. Weitere Informationen findest Du in der Dokumentation.

Browser Developer Console (Chrome) shows following error:
overview:1 Refused to connect to ‘http://xx.xxxxxxxx.de/remote.php/dav/’ because it violates the following Content Security Policy directive: “connect-src ‘self’”.

headers from /settings/admin/overview in my browser:
content-security-policy:
default-src ‘none’;base-uri ‘none’;manifest-src ‘self’;script-src ‘nonce-TWorc0V6MGtSODlPdFVDVlFFSnpqZjhLRVFEakpNelFnc3JiRGZzLzAvND06Zmt2TkpRcGlGWjBleFRuZUt3VXJ6cG9oZGtqU2RZMjN6Nm4wUmJodzVLMD0=’;style-src ‘self’ ‘unsafe-inline’;img-src ‘self’ data: blob:;font-src ‘self’ data:;connect-src ‘self’;media-src ‘self’;frame-src https://xx.xxxxxxxxx.de

I see there is a http and not https request uri to /remote.php/dav/. i don’t know where it comes from. All things are working to client with https

Is this the first time you’ve seen this error? (Y/N): N

Steps to replicate it:

  1. Login as Admin
  2. Move to Settings -> Overview Page

The output of your Nextcloud log in Admin > Logging:

nothing to show

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

<?php                                                                                                                                                                                   
$CONFIG = array (                                                                                                                                                                       
  'instanceid' => 'xxxxxxxx',                                                                                                                                                       
  'passwordsalt' => 'xxxxxxxxx',                                                                                                                                   
  'secret' => 'xxxxxxxxx',                                                                                                                       
  'trusted_domains' =>                                                                                                                                                                  
  array (                                                                                                                                                                               
    0 => 'xx.xxxxxxx.de',                                                                                                                                                             
    1 => 'xx.xxxxxxx.de.',                                                                                                                                                            
  ),                                                                                                                                                                                    
  'trusted_proxies' => ['10.0.2.3'],                                                                                                                                                    
  'overwriteprotocol' => 'https',                                                                                                                                                       
  'datadirectory' => '/var/www/html/data',                                                                                                                                              
  'overwrite.cli.url' => 'https://xxxxxxx/',                                                                                                                                    
  'htaccess.RewriteBase' => '/',                                                                                                                                                        
  'dbtype' => 'mysql',                                                                                                                                                                  
  'version' => '15.0.2.0',                                                                                                                                                              
  'dbname' => 'xxxxxx',                                                                                                                                                     
  'dbhost' => 'localhost',                                                                                                                                                              
  'dbport' => '',                                                                                                                                                                       
  'dbtableprefix' => 'oc_',                                                                                                                                                             
  'dbuser' => 'xxxxxx',                                                                                                                                                     
  'dbpassword' => 'xxxxxxx',                                                                                                                                               
  'logtimezone' => 'UTC',                                                                                                                                                               
  'installed' => true,                                                                                                                                                                  
  'mail_from_address' => 'nextcloud',                                                                                                                                                   
  'mail_smtpmode' => 'sendmail',                                                                                                                                                        
  'mail_domain' => 'xxxxxx.xx',                                                                                                                                                      
  'mail_smtpsecure' => 'tls',                                                                                                                                                           
  'mail_smtphost' => 'xxxxxxe',                                                                                                                                               
  'mail_smtpauth' => 1,                                                                                                                                                                 
  'mail_smtpauthtype' => 'PLAIN',                                                                                                                                                       
  'mail_smtpname' => 'xxxxxx',                                                                                                                                              
  'mail_smtppassword' => 'xxxxxx',                                                                                                                                                 
  'mail_smtpport' => '587',                                                                                                                                                             
  'appstore.experimental.enabled' => false,                                                                                                                                             
  'loglevel' => 0,                                                                                                                                                                      
  'maintenance' => false,                                                                                                                                                               
  'theme' => '',                                                                                                                                                                        
  'enable_previews' => true,                                                                                                                                                            
  'preview_max_x' => NULL,                                                                                                                                                              
  'preview_max_y' => NULL,                                                                                                                                                              
  'preview_max_scale_factor' => 1,                                                                                                                                                      
  'memcache.local' => '\\OC\\Memcache\\APCu',                                                                                                                                           
  'memcache.locking' => '\\OC\\Memcache\\Redis',                                                                                                                                        
  'redis' =>                                                                                                                                                                            
  array (                                                                                                                                                                               
    'host' => '/var/run/redis/redis-server.sock',                                                                                                                                       
    'port' => 0,                                                                                                                                                                        
    'timeout' => 0,                                                                                                                                                                     
  ),                                                                                                                                                                                    
); 

The output of your Apache/nginx/system log in /var/log/____:

access_oc.log:xxxxxxxx 10.0.2.3 - - [16/Jan/2019:12:50:55 +0000] "PROPFIND /.well-known/caldav HTTP/1.1" 301 546 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36"                                                                                                                                       
access_oc.log:xxxxxxxx 10.0.2.3 - - [16/Jan/2019:12:50:55 +0000] "PROPFIND /.well-known/carddav HTTP/1.1" 301 546 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36"

haproxy config:

frontend outer_web                                                                                                                                                                      
        bind 10.0.2.3:80                                                                                                                                                                
        bind fd99:0:0:2:216:3eff:fe09:7675:80                                                                                                                                           
        bind 10.0.2.3:443 ssl crt-list /etc/haproxy/crt-list.txt alpn h2,http/1.1                                                                                                       
        bind fd99:0:0:2:216:3eff:fe09:7675:443 ssl crt-list /etc/haproxy/crt-list.txt alpn h2,http/1.1                                                                                 
        mode http                                                                                                                                                                       
        option forwardfor                                                                                                                                                               
        compression algo gzip                                                                                                                                                           
        compression type text/html text/plain text/css                                                                                                                                  
        http-request set-header X-Forwarded-Proto https if { ssl_fc }                                                                                                                  
        acl le-acl      path_beg /.well-known/acme-challenge/                                                                                                                                              
        acl host_de_xxxxxx_oc        hdr(host) -m beg -i oc.xxxxxx.de                                                                                                                    
        use_backend     backend_le      if      le-acl                                                                                                                                                          
        use_backend     backend_de_xxxxxx_oc         if      host_de_xxxxxxxx_oc

backend backend_de_xxxxxxx_oc                                                                                                                                                         
        mode http                                                                                                                                                                       
        #compression offload                                                                                                                                                            
        http-response set-header Strict-Transport-Security max-age=16000000;\ includeSubDomains;\ preload;                                                                              
        redirect scheme https if !{ ssl_fc }                                                                                                                                            
        server  vB02-de-xxxxxx-oc    10.0.2.12:81 
1 Like

Solved the issue after packet capture and analysis

The problem is found in the .htaccess file.
To solve the redirect issue i added %{HTTP:X-Forwarded-Proto}://%{HTTP_HOST} to the RewriteRules.

“SetEnvIf X-Forwarded-Proto https HTTPS” is enabled in the Apache2 config, but REQUEST_SCHEME variable doesnt change. And i dont know how to change it.
I think a change of REQUEST_SCHEME from http to https will made the changes in the htaccess file unneeded.

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{HTTP_USER_AGENT}  DavClnt
  RewriteRule ^$         %{HTTP:X-Forwarded-Proto}://%{HTTP_HOST}/remote.php/webdav/          [L,R=302]
  RewriteRule .* - [env=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  RewriteRule ^\.well-known/host-meta %{HTTP:X-Forwarded-Proto}://%{HTTP_HOST}/public.php?service=host-meta [QSA,L]
  RewriteRule ^\.well-known/host-meta\.json %{HTTP:X-Forwarded-Proto}://%{HTTP_HOST}/public.php?service=host-meta-json [QSA,L]
  RewriteRule ^\.well-known/webfinger %{HTTP:X-Forwarded-Proto}://%{HTTP_HOST}/public.php?service=webfinger [QSA,L]
  RewriteRule ^\.well-known/carddav %{HTTP:X-Forwarded-Proto}://%{HTTP_HOST}/remote.php/dav/ [R=301,L]
  #RewriteRule ^\.well-known/caldav /remote.php/dav/ [R=301,L]
  RewriteRule ^\.well-known/caldav %{HTTP:X-Forwarded-Proto}://%{HTTP_HOST}/remote.php/dav/ [R=301,L]
  RewriteRule ^remote/(.*) remote.php [QSA,L]
  RewriteRule ^(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
  RewriteCond %{REQUEST_URI} !^/\.well-known/(acme-challenge|pki-validation)/.*
  RewriteRule ^(?:\.|autotest|occ|issue|indie|db_|console).* - [R=404,L]
</IfModule>
1 Like