JSON formatting bug when creating new secret

[harryheck]

Hey everyone,

after updating to 1.21.0 yesterday, when creating a new secret with "Create Secret", the JSON view formatting looks all wrong:

Steps to reproduce the behavior (on my end):

1. Click "Create Secret" in upper right corner
2. Click on JSON at the top
3. See wrong formatting

Anybody else have this problem? JSON looks fine when I'm editing already existing secrets.

Thanks in advance

[hellobontempo]

👋 When I go to create a new secret empty strings render in the JSON Editor. Are you seeing any console errors? Also, what browser are you using?

[harryheck]

I found the root cause and resolved the issue. It turns out this was not a bug in the Vault binary, but a Content Security Policy (CSP) conflict (possibly triggered by new UI components introduced in 1.21.x.?)

Diagnosis

My Vault instance runs behind an Nginx reverse proxy which was configured with a strict CSP header (default-src 'self'). While this worked for previous Vault versions, the new JSON editor component relies on inline styles, which were blocked by the browser.

The browser console confirmed this with multiple errors:

Applying inline style violates the following Content Security Policy directive 'default-src 'self''. [...] Note also that 'style-src' was not explicitly set.

The Fix

I had to explicitly allow unsafe-inline for styles in my Nginx configuration to make the JSON editor render correctly again.

Before (Broken in 1.21.x):

add_header Content-Security-Policy "default-src 'self';" always;

After (Working):

add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; img-src 'self' data:;" always;