There is no error message informing user about entering wrong password when downloading submissions from encrypted project

[srujner]

Problem description

The issue was first reported in the comments below: #1011 and it was fixed there so it is a regression.

There is no error message informing user about entering wrong password when downloading submissions from encrypted project

Steps to reproduce the problem

1. Open encrypted project with some submissions in it
2. Navigate to the Submission tab and click on the Download button
3. Provide wrong password and click on the button next to the All data and Attachments
4. The window will automatically close and you'll see message: "Data download should begin soon. Once it begins, you can close this message. If it hasn’t started in 20 seconds, please try again." But nothing happens

Expected behavior

There should be error message after providing the wrong password

Central version shown in version.txt

ee0e420 (v2026.2.0)
0000000000000000000000000000000000000000 client (v2026.2.0)
bee93414a2215bd73d7f371113c6640c66d90c95 server (v2026.2.0)

Browser version

Firefox 136.0 (64-bit)
Google Chrome 130.0.6723.69

[debkarma]

Hi @srujner @matthew-white I would love to take this up. I have experience with JavaScript frontend development, and since the reproduction steps are so clear, I'd like to investigate why this regression happened.

Could you assign this to me? I'll start looking into the UI password validation logic. cheers!

[matthew-white]

Hi @debkarma, thank you for your interest! This issue is a regression scheduled to be fixed for the next release. Given that it's time-constrained, it's probably not the best first issue. That said, if you have experience with frontend JS and an interest in contributing, we certainly have other small, reproducible issues for which we'd welcome a PR.

Note that we generally don't assign issues outside the ODK team. If you find an issue you'd like to work on, just leave a comment on the issue telling us that you're interested and push a PR once you're ready.

[matthew-white]

I took a quick first look at this issue. Let me CC @alxndrsn here because I think it's possible that this is related to recent changes to our CSP. When I follow the repro steps, I see that a request is sent to /csp-report. I also see the following error in the browser console:

Framing 'https://staging.getodk.cloud/' violates the following Content Security Policy directive: "frame-ancestors 'none'". The request has been blocked.

The SubmissionDownload component is unusual in that it renders an HTML form within an iframe. If the request fails due to a wrong password, the iframe renders the Problem JSON from Central Backend, which Central Frontend then parses. I'm wondering if our CSP on Central Backend endpoints is preventing the iframe from rendering the Backend error response.

So question 1 to me is whether we need to do anything to adjust our CSP. Question 2 is why an error wasn't eventually shown in the toast. If Central Frontend is unable to parse the Problem JSON, it's supposed to show a different error. Yet that error isn't being shown. That's perhaps due to this other error I see in the browser console:

Uncaught SecurityError: Failed to read a named property 'document' from 'Window': Blocked a frame with origin "https://staging.getodk.cloud" from accessing a cross-origin frame.

I think that's this line, and I'm guessing it's because the iframe is rendering a Chrome error page for ERR_BLOCKED_BY_RESPONSE. I think we should update checkForProblem() to show an error toast in more cases:

• When access to iframe.contentWindow.document fails
• (Unrelated case, but another case I'm noticing) When the JSON parsing is successful, but doesn't match the Central Problem format (when isProblem() returns false)

@alxndrsn, would you mind looking into question 1? I think I can push a quick PR to address question 2.

[alxndrsn]

I'm wondering if our CSP on Central Backend endpoints is preventing the iframe from rendering the Backend error response.

Should be easy enough to check - any CSP violation should show up in the browser console, and generate an HTTP POST to /csp-report.

[matthew-white]

I do see an HTTP request to /csp-report, along with this logging in the browser console:

Framing 'https://staging.getodk.cloud/' violates the following Content Security Policy directive: "frame-ancestors 'none'". The request has been blocked.

I think we need to adjust the following line of the CSP in order for the Backend Problem JSON to be rendered in the browser as it was in the past. I think this is a CSP-related regression in v2026.2.

central/files/nginx/odk.conf.template

Line 113 in 3e9b78f

"" "default-src 'report-sample' 'none'; form-action 'none'; frame-ancestors 'none'; img-src http://${DOMAIN}/favicon.ico; report-uri /csp-report";

Would it be reasonable to add self to frame-ancestors here? That seems like the simplest approach to me, but I'm not sure if there's a better alternative.