# Attachments not downloading on web version due to CSP

**URL:** <https://vaultwarden.discourse.group/t/attachments-not-downloading-on-web-version-due-to-csp/3907>\
**Category:** Help\
**Created:** [August 19, 2024, 4:39am UTC](https://vaultwarden.discourse.group/t/attachments-not-downloading-on-web-version-due-to-csp/3907 "2024-08-19T04:39:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zxurian](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/zxurian/32/1506_2.png) [@zxurian](https://vaultwarden.discourse.group/u/zxurian)\
**Post date:** [August 19, 2024, 4:39am UTC](https://vaultwarden.discourse.group/t/attachments-not-downloading-on-web-version-due-to-csp/3907/1 "2024-08-19T04:39:35Z")

</div>

Don’t know if this is a bug or a configuration issue, so starting here.

Using Vaultwarden Web, Version 2024.6.2

I have Vaultwarden container setup behind a Cloudflare Tunnel container.

- Accessing Vaultwarden via website of `https://vaultwarden.xxxx.com` works
- Accessing Vaultwarden via Bitwarden desktop app configured for self-hosted site of same domain works
- Downloading attachments via Bitwarden desktop app works
- Downloading attachments via website does _not_ work.

I get the following error in devtools when attempting to click on an attachment via the website.

```auto
attachments.component.ts:160
Refused to connect to 'http://vaultwarden.xxxx.com/attachments/yyyy/zzzz?token=<token>' because it violates the following Content Security Policy directive: "connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory https://app.simplelogin.io/api/ https://app.addy.io/api/ https://api.fastmail.com/ https://api.forwardemail.net".
attachments.component.ts:160
Refused to connect to 'http://vaultwarden.xxxx.com/attachments/yyyy/zzzz?token=<token>' because it violates the document's Content Security Policy.
console-log.service.ts:51
Unhandled error in angular Error: Uncaught (in promise): TypeError: Failed to fetch
TypeError: Failed to fetch

```

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [August 19, 2024, 5:13am UTC](https://vaultwarden.discourse.group/t/attachments-not-downloading-on-web-version-due-to-csp/3907/2 "2024-08-19T05:13:38Z")

</div>

Check your diagnostics page in the Vaultwarden Admin `/admin/diagnostics` page and see if there are errors there.

---

<div class="post-metadata">

**Author:** ![zxurian](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/zxurian/32/1506_2.png) [@zxurian](https://vaultwarden.discourse.group/u/zxurian)\
**Post date:** [August 19, 2024, 3:30pm UTC](https://vaultwarden.discourse.group/t/attachments-not-downloading-on-web-version-due-to-csp/3907/3 "2024-08-19T15:30:19Z")

</div>

thank you. missing sauce was I still had Domain URL set for `http` vs `https`.