Skip to main content

Troubleshooting

Failure Creating Vault in Katta Web​

Katta Web uploads the vault template to the S3 bucket directly from the browser. Two things must be configured for this to work:

Katta Desktop

The following only applies to Katta Web. Katta Desktop is not subject to browser CORS restrictions.

  • S3 Bucket CORS Settings. The bucket S3 endpoint must allow requests from the Katta Web origin. Refer to S3 Bucket CORS Settings in the Admin Guide for setup instructions.

  • Content Security Policy (CSP) Settings of Katta Server. The Content Security Policy (CSP) settings of Katta Server must include the S3 endpoints of the storage profile. If a host is missing, the browser blocks the request before and uploading the vault template fails in Katta Web:

    Connecting to 'https://your-storage-provider.example.com' violates the following Content Security Policy directive: "connect-src 'self' localhost:9100 http://localhost:8380". The action has been blocked.

    Uploading vault template failed. TypeError: Failed to fetch. Refused to connect because it violates the document's Content Security Policy.

    The connect-src directive must list every host the browser talks to directly:

    • Katta Server itself, covered by 'self'
    • The Keycloak URL
    • The S3 endpoint of each storage profile
    • The STS endpoint of each storage profile

    Refer to Deployment in the Self-Hosting Guide for setup instructions.

    tip

    Verify the effective policy with:

    curl -sI https://your-katta-server.example.com/ | grep -i content-security-policy

    That will print the response header like:

    Content-Security-Policy: default-src 'self'; connect-src 'self' https://keycloak.example.com https://*.wasabisys.com; object-src 'none'; child-src 'self'; img-src * data:; frame-ancestors 'none'