gwp troubleshooting

Genetec Web Player troubleshooting

Use this section to diagnose common GWP startup, authentication, CORS, library-loading, and browser-debugging issues.

Fix browser certificate trust errors

You might see these symptoms:

• Browser shows security warning or blocks connection
• "Your connection is not private" or "NET::ERR_CERT_AUTHORITY_INVALID" error
• Unable to load gwp.js or connect to Media Gateway
• Console shows certificate errors

If the browser reports that the Media Gateway's self-signed SSL certificate is untrusted, use one of these fixes:

1. Accept the certificate in the browser for development or testing. Go directly to the Media Gateway URL in your browser: https://<MediaGatewayAddress>. When the browser shows the security warning, click Advanced, then click Proceed to [site] or the equivalent browser option. This adds a temporary exception for the certificate. This option only works for testing and must be done in each browser and device.

2. Install a valid SSL certificate for production. Obtain an SSL certificate from a trusted Certificate Authority (CA), install the certificate on the Media Gateway server, and configure Media Gateway to use the valid certificate. This is the recommended approach for production environments.

3. Install the self-signed certificate in the operating system for development. Export the self-signed certificate from the Media Gateway, install it in the operating system's trusted root certificate store, and restart the browser after installation. This is more permanent than a browser exception but still not recommended for production.

Important

Self-signed certificates should only be used in development and testing environments. Production environments should always use certificates from trusted Certificate Authorities.

Fix token authorization errors

You might see these symptoms:

• HTTP 401 Unauthorized error when retrieving token
• Error code 16 (InsufficientPrivilege)
• Video player fails to start or shows permission error
• "Access denied" messages

Token retrieval failed. For HTTP 401 responses, Media Gateway returns the authentication result in the response body. Use that value to choose the next check instead of relying only on the HTTP status text.

Common 401 response bodies:

Response body	What to check
BadCredentials	Verify the user name, password, and Basic <Base64(username;sdkCertificate:password)> header format.
InsufficientPrivileges	Verify the user has the Web App application privilege and at least one of View live video or View playback on the requested camera.
MissingSdkCertificate	Add the SDK certificate to the user name part of the Basic credential string: username;sdkCertificate.
InvalidSdkCertificate	Verify that the SDK certificate string matches the Security Center license.
MissingMediaSdkLicense	Verify that the Security Center system has a Media SDK license.
Unknown	Verify that the request includes a supported authentication header.

Check credentials

1. Verify the username and password.
2. Verify the SDK certificate string.
3. Check the Authorization header format: Basic <Base64(username;sdkCertificate:password)>.
4. Ensure no extra spaces or special characters in credentials.
5. Test logging on to Security Center Config Tool to confirm that the credentials work.

Check Security Center privileges

Required access for GWP camera streaming:

• A valid Security Center user name and password, or another supported authentication method.
• A valid SDK certificate.
• A Security Center system with a Media SDK license.
• The Web App application privilege.
• At least one of View live video or View playback on the requested camera.

Additional privileges depending on features used:

• For PTZ, check PTZ motor privileges. The parent View live video privilege must be granted first.

See the complete Security Center privileges section for details.

Check partition access rights

1. In Security Center Config Tool, go to User management.
2. Select the user.
3. Open the Access rights tab.
4. Verify that the user has access to the camera's partition.

Privileges alone do not grant access to the camera's partition.

Check camera configuration

1. Verify the camera GUID is correct.
2. Ensure the camera exists and is online in Security Center.
3. Check that the camera is assigned to a partition the user can access.

Test token retrieval with this pattern:

// Test token retrieval
const testToken = async () => {
    try {
        const response = await fetch(`${mediaGatewayEndpoint}/v2/token/${cameraId}`, {
            credentials: 'include',
            headers: {
                'Authorization': `Basic ${btoa(username + ";" + sdkCertificate + ":" + password)}`
            }
        });

        const responseText = await response.text();
        console.log('Status:', response.status);
        if (response.ok) {
            console.log('Token retrieved successfully');
        } else {
            console.error('Failed:', response.status, responseText || response.statusText);
        }
    } catch (error) {
        console.error('Error:', error);
    }
};

Fix CORS errors

You might see these symptoms:

• Browser console shows CORS errors
• "Access to fetch/XMLHttpRequest blocked by CORS policy" error
• "No 'Access-Control-Allow-Origin' header is present"
• Token retrieval or WebSocket connection fails

The browser is rejecting the cross-origin request. GWP endpoint paths are handled by Media Gateway's GWP endpoint CORS behavior, so first verify the request URL and origin. If your application calls endpoints that are subject to strict origin checks, verify that the configured policy includes your web application's exact origin.

1. Verify the GWP endpoint URL.

   Make sure your application calls the GWP endpoints exposed by Media Gateway under the configured application path, such as /media/v2/token/{cameraId}, /media/v2/files/gwp.js, and /media/v2/ws when the application path is media.

2. Configure Media Gateway CORS settings if your application calls endpoints that require an explicit origin policy.

   Modify the MediaGateway.gconfig file located in the ConfigurationFiles directory:

   C:\Program Files (x86)\Genetec Security Center X.X\ConfigurationFiles\MediaGateway.gconfig
   

   Option A: Allow specific origins (recommended)

   <?xml version="1.0" encoding="UTF-8"?>
   <configuration>
       <MediaGateway EnforceStrictCrossOrigin="true">
           <AllowedOrigin Origin="https://yourapp.example.com" />
           <AllowedOrigin Origin="http://localhost:3000" />
       </MediaGateway>
   </configuration>

   Option B: Allow all origins (development only, not recommended for production)

   <?xml version="1.0" encoding="UTF-8"?>
   <configuration>
       <MediaGateway EnforceStrictCrossOrigin="false"/>
   </configuration>

3. Restart the Media Gateway role after modifying the configuration file.

4. Verify your application's origin.

   • Origin includes protocol, domain, and port.
   • Examples: https://app.example.com, http://localhost:3000, https://192.168.1.100:8080
   • Make sure the exact origin is listed in the configuration.

5. Check for multiple origins. If testing from multiple locations (localhost, staging, production), add all origins.

Common CORS mistakes include:

• Calling a non-GWP endpoint by mistake
• Forgetting to restart Media Gateway after config change
• Origin mismatch (for example, http vs https, different port numbers)
• Trailing slashes in origin URLs
• Using IP address in code but domain name in CORS config (or vice versa)

See Cross-origin resource sharing (CORS) for more details.

Fix a gwp.js source mismatch

You might see these symptoms:

• Unexpected errors or exceptions
• Missing methods or properties
• Features not working as documented
• "undefined is not a function" errors
• Inconsistent behavior

Check whether the browser is using a stale gwp.js file or a library version that differs from the one served by the connected Media Gateway. Switching endpoints during failover retains the loaded library; using a different endpoint alone does not establish a version mismatch. Compatibility between different versions is not guaranteed.

1. Always load gwp.js from Media Gateway.

   Correct approach:

   <script src="https://<MediaGatewayAddress>/media/v2/files/gwp.js"></script>

   Incorrect approaches:

   • Using a downloaded or cached copy from a different Security Center version
   • Hosting gwp.js on your own server

2. Record the GWP library version.

   // Check GWP version
   console.log('GWP Version:', gwp.version());

3. Clear the browser cache. The browser may be caching an old version of gwp.js. Hard refresh with Ctrl+F5 on Windows or Cmd+Shift+R on macOS, clear the browser cache completely, or try in incognito/private browsing mode.

4. Check for multiple script tags. Ensure you're not loading gwp.js multiple times. Check that no other libraries are loading an older version.

5. After a Security Center upgrade, account for browser-cached files.

   • If Security Center was upgraded, the gwp.js file changes automatically

   • Users with cached versions have mismatches

   • Consider cache-busting strategies:

     <script src="https://<MediaGatewayAddress>/media/v2/files/gwp.js?v=<cache-version>"></script>

To prevent source mismatches:

• Always reference gwp.js from the Media Gateway server.
• Do not download and host gwp.js separately.
• Document the GWP library version and Security Center version your application is tested with.
• Test thoroughly after Security Center upgrades.

See the Installation section for more details.

Use browser developer tools

Enable GWP logs and use browser developer tools to diagnose issues:

// Enable detailed GWP logging
gwp.enableLogs(true);

Check the browser console

1. Press F12 to open browser developer tools.
2. Go to the Console tab.
3. Look for error messages, warnings, or GWP logs.
4. Note error codes and descriptions.

Check the Network tab

In Chrome, Edge, or Firefox, use these steps to inspect token requests and the WebSocket connection to Media Gateway:

1. Open browser developer tools.
2. Go to the Network tab.
3. Clear the network filters before inspecting token requests. Check for failed requests or CORS errors.
4. Filter for WebSocket connections to inspect the connection to Media Gateway.

If your application retrieves tokens through a backend, the browser shows the request to that backend. Check the backend's request to Media Gateway separately.

Check the debug overlay

// Show diagnostic overlay on the player
webPlayer.showDebugOverlay(true);

The debug overlay displays real-time information about:

• Connection status
• Stream statistics
• Frame rate and codec information
• Buffering status

Getting additional help

If issues persist after trying the solutions above:

1. Enable verbose logging:

   gwp.enableLogs(true); // Enable intense logging

2. Gather diagnostic information:

   • GWP version: gwp.version()
   • Security Center version
   • Browser and OS version
   • Error codes from console
   • Network tab screenshots showing failed requests

3. Contact Genetec Support with the diagnostic information

Before contacting support, also confirm these points:

• Use logs: Enable GWP logs to gather detailed information:

  gwp.enableLogs();

• Check network accessibility: Ensure the Media Gateway is reachable from your network.

• Validate configuration: Confirm the Media Gateway role and permissions are properly configured in Security Center.

See also

• GWP developer guide: Setup, authentication, playback, and recovery guidance.