Web UI stuck on initializing

post by Benjamin_Holzapfel on Jun 26, 2025

Hello!

Since a few weeks my Nexus suddenly stopped working and the Web UI is stuck on initializing. No matter what version I use it is stuck on the same step. I thought it might be because I used an old SSL certificate that couldn’t be renewed but even without SSL it doesn’t work.

I am using Ubuntu 24.04 and Nexus repo CE 3.81.1-01 as you can see in the error log.

The server starts without any errors.

This is the error log from the Web UI:

Uncaught EvalError: Refused to evaluate a string as JavaScript because ‘unsafe-eval’ is not an allowed source of script in the following Content Security Policy directive: “default-src ‘self’ http: https: data: blob: ‘unsafe-inline’”.

at new Function (<anonymous>)
at ctor.compile (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:539753)
at ctor.applyOut (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:545989)
at ctor.apply (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:545762)
at Object.c [as url] (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:692599)
at ctor.c [as apply] (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:692944)
at ctor.apply (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:692262)
at ctor.constructProxy (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:720359)
at constructor.getProxy (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:755504)
at ctor.createImplicitModel (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:784675)

(baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1 Uncaught Error: Ext.Loader is not enabled, so dependencies cannot be resolved dynamically. Missing required class: Ext.container.Container

at new (baseapp-prod.js?_v=3.81.1-01&_e=COMMUNITY&_c=2025-06-11-1842-50766:1:73371)

post by mpiggott on Jun 27, 2025

I can only really suggest to look at tools that may interfere with requests such as adblockers, anti-virus, and proxies. Aside from that clear the browser’s cache and reload.

post by Benjamin_Holzapfel on Jul 15, 2025

Something is wrong with the CSP. The following two CSPs are sent if I access the website.

content-security-policy

default-src https: data: blob: ‘unsafe-inline’; script-src https: ‘unsafe-inline’ ‘unsafe-eval’

content-security-policy

default-src ‘self’ http: https: data: blob: ‘unsafe-inline’

I also change the setting proxy_set_header X-Forwarded-Proto in my nginx config from “https” to $scheme;

It seems like it’s somehow not completely being routed through nginx.

post by mpiggott on Jul 17, 2025

A quick verification when using the following schemes I see:

http: default-src http: data: blob: 'unsafe-inline'; script-src http: 'unsafe-inline' 'unsafe-eval'

https: default-src https: data: blob: 'unsafe-inline'; script-src https: 'unsafe-inline' 'unsafe-eval'

If you see more than one on the same request perhaps nginx is changing something.

post by Benjamin_Holzapfel on Jul 18, 2025

I found the error. Nginx defines a CSP header in the nginx.conf that all other configs derive from. This config somehow changed automatically and the header defined in there overrode the one sent by nexus. I removed the CSP header from that config and everything works fine now.