Browser blocks loading of VoidAuth behind Cloudflare DNS #352

New issue

Open

opened 2026-03-24 19:16:06 -05:00 by OtterBoops · 1 comment

OtterBoops commented

2026-03-24 19:16:06 -05:00

(Migrated from github.com)

Describe the bug:

VoidAuth page remains blank when behind Cloudflare with either the Rocket Loader or Real User Measurements features enabled.

To Reproduce:

Set up VoidAuth behind Caddy (That's what I use at least)
Set up a proxied DNS record in Cloudflare to VoidAuth
Visit the domain that VoidAuth is on. (auth.foo.bar)

Expected behavior:

I am aware of the need for strict Content Security Policies, and I would understand that this is intended behavior, however I would love to have the opportunity to whitelist domains/scripts.

Database Driver:

This is observed with both PG and SQLite

Screenshots:

Yes this is the entire content displayed on the page

Developer tools

Additional context:

Feel free to close this issue if you believe this could be a security concern.

A workaround to people that are running into this is to disable RUM and Rocket Loader in Domain > Rules > Overview for the specific subdomain.

### Describe the bug: VoidAuth page remains blank when behind Cloudflare with either the Rocket Loader or Real User Measurements features enabled. ### To Reproduce: - Set up VoidAuth behind Caddy (That's what I use at least) - Set up a proxied DNS record in Cloudflare to VoidAuth - Visit the domain that VoidAuth is on. (auth.foo.bar) ### Expected behavior: I am aware of the need for strict Content Security Policies, and I would understand that this is intended behavior, however I would love to have the opportunity to whitelist domains/scripts. ### Database Driver: This is observed with both PG and SQLite ### Screenshots: Yes this is the entire content displayed on the page <img width="2551" height="1251" alt="Image" src="https://github.com/user-attachments/assets/fee03a93-5d7a-4042-b5ed-a2d13031a498" /> Developer tools <img width="1456" height="189" alt="Image" src="https://github.com/user-attachments/assets/0bddde80-90ab-4384-b441-fae722a93146" /> ### Additional context: Feel free to close this issue if you believe this could be a security concern. A workaround to people that are running into this is to disable RUM and Rocket Loader in `Domain > Rules > Overview` for the specific subdomain. <img width="1368" height="319" alt="Image" src="https://github.com/user-attachments/assets/7629a439-ccdb-4622-a2ed-3bb03a865cb7" />

notquitenothing commented

2026-04-04 11:34:09 -05:00

(Migrated from github.com)

The error you were seeing makes sense, to avoid it there would need to be a configuration for additional allowed content sources. This is currently not planned but might be possible to implement.

Potential blockers include the default CSP for Angular which might have to be modified.

The error you were seeing makes sense, to avoid it there would need to be a configuration for additional allowed content sources. This is currently not planned but might be possible to implement. Potential blockers include the default CSP for Angular which might have to be modified.