[GH-ISSUE #800] "Download failed", "io.connection_error code=3, message=Bad request" #375

Closed
opened 2026-02-26 10:32:13 +03:00 by kerem · 12 comments
Owner

Originally created by @monochromec on GitHub (Mar 23, 2025).
Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/800

Originally assigned to: @igwyd on GitHub.

After installing and configuring OnlyOffice in a container (version "latest" on dockerhub) per the instructions at https://helpcenter.onlyoffice.com/docs/installation/docs-community-install-docker.aspx (the configuration went OK wrt. to setting up a reverse proxy for the OnlyOffice https endpoint which is then mapped onto the corresponding exposed container port), I get a "download failed" error window when trying to access an .ods file (for which OnlyOffice has been enabled as the default app in NC).

OnlyOffice starts the UI and then fails with this error message.

The out.log file of the converter in /var/log/onlyoffice contains the warning:

[WARN] [localhost] [docId] [userId] nodeJS - io.connection_error code=3, message=Bad request

The environment: Stock Bookworm with Apache and PHP installed from the OS repos, NC is version 30.0.8.

More than happy to provide additional info as required, just let me know.

Originally created by @monochromec on GitHub (Mar 23, 2025). Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/800 Originally assigned to: @igwyd on GitHub. After installing and configuring OnlyOffice in a container (version "latest" on dockerhub) per the instructions at https://helpcenter.onlyoffice.com/docs/installation/docs-community-install-docker.aspx (the configuration went OK wrt. to setting up a reverse proxy for the OnlyOffice https endpoint which is then mapped onto the corresponding exposed container port), I get a "download failed" error window when trying to access an .ods file (for which OnlyOffice has been enabled as the default app in NC). OnlyOffice starts the UI and then fails with this error message. The out.log file of the converter in `/var/log/onlyoffice` contains the warning: ```[WARN] [localhost] [docId] [userId] nodeJS - io.connection_error code=3, message=Bad request``` The environment: Stock Bookworm with Apache and PHP installed from the OS repos, NC is version 30.0.8. More than happy to provide additional info as required, just let me know.
kerem 2026-02-26 10:32:13 +03:00
Author
Owner

@igwyd commented on GitHub (Mar 24, 2025):

Hello @monochromec, describe please how you started the onlyoffice-documentserver, show the command. What proxy server did you use and show its configuration.

<!-- gh-comment-id:2748047988 --> @igwyd commented on GitHub (Mar 24, 2025): Hello @monochromec, describe please how you started the onlyoffice-documentserver, show the command. What proxy server did you use and show its configuration.
Author
Owner

@monochromec commented on GitHub (Mar 24, 2025):

Container creation:

docker run --rm -i -t -d -p 9880:80 -v /var/lib/postgresql:/var/lib/<mount_oo_path>/postgresql -v /var/lib/redis:/var/lib/<mount_oo_path>/redis -v /var/lib/rabbitmq:/var/lib/<mount_oo_path>/rabbitmq -v /var/log/onlyoffice:/var/lib/<mount_oo_path>/log -e JWT_SECRET=xxxx onlyoffice/documentserver

Apache config:

# virtualhost preambel, proxy and ssl modules check omitted
 ProxyPass /oo http://127.0.0.1:9880 nocanon
 ProxyPassReverse /oo http://127.0.0.1:9880

OO config:

ONLYOFFICE Docs address: https://<FQDN>/oo
ONLYOFFICE Docs address for internal requests: http://localhost:9880

Please let me know if additional information is required.

<!-- gh-comment-id:2748652785 --> @monochromec commented on GitHub (Mar 24, 2025): Container creation: `docker run --rm -i -t -d -p 9880:80 -v /var/lib/postgresql:/var/lib/<mount_oo_path>/postgresql -v /var/lib/redis:/var/lib/<mount_oo_path>/redis -v /var/lib/rabbitmq:/var/lib/<mount_oo_path>/rabbitmq -v /var/log/onlyoffice:/var/lib/<mount_oo_path>/log -e JWT_SECRET=xxxx onlyoffice/documentserver ` Apache config: ``` # virtualhost preambel, proxy and ssl modules check omitted ProxyPass /oo http://127.0.0.1:9880 nocanon ProxyPassReverse /oo http://127.0.0.1:9880 ``` OO config: ``` ONLYOFFICE Docs address: https://<FQDN>/oo ONLYOFFICE Docs address for internal requests: http://localhost:9880 ``` Please let me know if additional information is required.
Author
Owner

@igwyd commented on GitHub (Mar 25, 2025):

As far as i can see the issue is in the proxy settings, look at our proxy examples - https://helpcenter.onlyoffice.com/docs/installation/docs-community-proxy.aspx

<!-- gh-comment-id:2750154661 --> @igwyd commented on GitHub (Mar 25, 2025): As far as i can see the issue is in the proxy settings, look at our proxy examples - https://helpcenter.onlyoffice.com/docs/installation/docs-community-proxy.aspx
Author
Owner

@monochromec commented on GitHub (Mar 26, 2025):

Unfortunately the Apache proxy configuration as outlined in the docs above simply cause the files to be offered for download instead of editing them in place.

Also the header modifications cause NC to issue corresponding warnings about potential security issues due to wrong header configuration.

<!-- gh-comment-id:2753910948 --> @monochromec commented on GitHub (Mar 26, 2025): Unfortunately the Apache proxy configuration as outlined in the docs above simply cause the files to be offered for download instead of editing them in place. Also the header modifications cause NC to issue corresponding warnings about potential security issues due to wrong header configuration.
Author
Owner

@igwyd commented on GitHub (Mar 26, 2025):

Are you talking about the configuration with virtual path right? https://github.com/ONLYOFFICE/document-server-proxy/blob/master/apache/proxy-to-virtual-path.conf

<!-- gh-comment-id:2754151984 --> @igwyd commented on GitHub (Mar 26, 2025): Are you talking about the configuration with virtual path right? https://github.com/ONLYOFFICE/document-server-proxy/blob/master/apache/proxy-to-virtual-path.conf
Author
Owner

@monochromec commented on GitHub (Mar 26, 2025):

No, sorry, misunderstanding.

As outlined above (see ProxyPath configuration), I'm reverse-proxying https (path https://<FQDN>/oo) to http://127.0.0.1:9880 (9880 is the exposed container port on the same machine).

That's why I am using https://github.com/ONLYOFFICE/document-server-proxy/blob/master/apache/proxy-https-to-http.conf .

<!-- gh-comment-id:2754851362 --> @monochromec commented on GitHub (Mar 26, 2025): No, sorry, misunderstanding. As outlined above (see ProxyPath configuration), I'm reverse-proxying https (path `https://<FQDN>/oo`) to `http://127.0.0.1:9880` (9880 is the exposed container port on the same machine). That's why I am using https://github.com/ONLYOFFICE/document-server-proxy/blob/master/apache/proxy-https-to-http.conf .
Author
Owner

@igwyd commented on GitHub (Mar 27, 2025):

Because you are using https://<FQDN>/oo (/oo here is vpath), then you need use both of those configs. Take as a basis https://github.com/ONLYOFFICE/document-server-proxy/blob/master/apache/proxy-to-virtual-path.conf and add SSL part from https://github.com/ONLYOFFICE/document-server-proxy/blob/master/apache/proxy-https-to-http.conf this should work.

<!-- gh-comment-id:2756791288 --> @igwyd commented on GitHub (Mar 27, 2025): Because you are using `https://<FQDN>/oo` (**/oo** here is vpath), then you need use both of those configs. Take as a basis https://github.com/ONLYOFFICE/document-server-proxy/blob/master/apache/proxy-to-virtual-path.conf and add SSL part from https://github.com/ONLYOFFICE/document-server-proxy/blob/master/apache/proxy-https-to-http.conf this should work.
Author
Owner

@monochromec commented on GitHub (Mar 30, 2025):

Unfortunately still doesn't work even after merging the two config suggestions as the browser still prompts for downloading the file instead of passing this onto OnlyOffice . This is what the new config looks like (SSL config etc omitted):

 Define VPATH /oo
    Define DS_ADDR localhost:9880
    <Location ${VPATH}>
        Require all granted
        SetEnvIf Host "^(.*)$" THE_HOST=$1
        RequestHeader setifempty X-Forwarded-Proto http
        RequestHeader setifempty X-Forwarded-Host %{THE_HOST}e
        RequestHeader edit X-Forwarded-Host (.*) $1${VPATH}
        ProxyAddHeaders Off
    </Location>
    RewriteEngine on
    RewriteCond %{HTTP:Upgrade} websocket [NC]
    RewriteCond %{HTTP:Connection} upgrade [NC]
    RewriteRule ^\$VPATH/?(.*) "ws://${DS_ADDR}/$1" [P,L]
    ProxyPass ${VPATH} http://${DS_ADDR}
    ProxyPassReverse ${VPATH} http://${DS_ADDR}
    RewriteEngine off

Any thoughts?

<!-- gh-comment-id:2764615767 --> @monochromec commented on GitHub (Mar 30, 2025): Unfortunately still doesn't work even after merging the two config suggestions as the browser still prompts for downloading the file instead of passing this onto OnlyOffice . This is what the new config looks like (SSL config etc omitted): ``` Define VPATH /oo Define DS_ADDR localhost:9880 <Location ${VPATH}> Require all granted SetEnvIf Host "^(.*)$" THE_HOST=$1 RequestHeader setifempty X-Forwarded-Proto http RequestHeader setifempty X-Forwarded-Host %{THE_HOST}e RequestHeader edit X-Forwarded-Host (.*) $1${VPATH} ProxyAddHeaders Off </Location> RewriteEngine on RewriteCond %{HTTP:Upgrade} websocket [NC] RewriteCond %{HTTP:Connection} upgrade [NC] RewriteRule ^\$VPATH/?(.*) "ws://${DS_ADDR}/$1" [P,L] ProxyPass ${VPATH} http://${DS_ADDR} ProxyPassReverse ${VPATH} http://${DS_ADDR} RewriteEngine off ``` Any thoughts?
Author
Owner

@igwyd commented on GitHub (May 12, 2025):

Worked for me (replace example.com):

Define VPATH /oo
Define DS_ADDRESS 127.0.0.1:9880

<VirtualHost *:443>
  ServerName example.com

  SSLEngine on
  SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

  <Location ${VPATH}>
    Require all granted
    SetEnvIf Host "^(.*)$" THE_HOST=$1
    RequestHeader setifempty X-Forwarded-Proto https
    RequestHeader setifempty X-Forwarded-Host %{THE_HOST}e
    RequestHeader edit X-Forwarded-Host (.*) $1${VPATH}
    ProxyAddHeaders Off
  </Location>

  RewriteEngine on
  RewriteCond %{HTTP:Upgrade} websocket [NC]
  RewriteCond %{HTTP:Connection} upgrade [NC]
  RewriteRule ^\${VPATH}/?(.*) "wss://${DS_ADDRESS}/$1" [P,L]

  ProxyPass ${VPATH} "http://${DS_ADDRESS}"
  ProxyPassReverse ${VPATH} "http://${DS_ADDRESS}"
</VirtualHost>

Check with your integration NC, included test example does not know anything about the proxy and virtual path and will not work.

<!-- gh-comment-id:2871325115 --> @igwyd commented on GitHub (May 12, 2025): Worked for me (replace **example.com**): ``` Define VPATH /oo Define DS_ADDRESS 127.0.0.1:9880 <VirtualHost *:443> ServerName example.com SSLEngine on SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem <Location ${VPATH}> Require all granted SetEnvIf Host "^(.*)$" THE_HOST=$1 RequestHeader setifempty X-Forwarded-Proto https RequestHeader setifempty X-Forwarded-Host %{THE_HOST}e RequestHeader edit X-Forwarded-Host (.*) $1${VPATH} ProxyAddHeaders Off </Location> RewriteEngine on RewriteCond %{HTTP:Upgrade} websocket [NC] RewriteCond %{HTTP:Connection} upgrade [NC] RewriteRule ^\${VPATH}/?(.*) "wss://${DS_ADDRESS}/$1" [P,L] ProxyPass ${VPATH} "http://${DS_ADDRESS}" ProxyPassReverse ${VPATH} "http://${DS_ADDRESS}" </VirtualHost> ``` Check with your integration NC, included test example does not know anything about the proxy and virtual path and will not work.
Author
Owner

@monochromec commented on GitHub (May 19, 2025):

Still not working with the configuration outlined above.

Also: Is the websocket URL correct ("wss://${DS_ADDRESS}/$1" instead of "ws://${DS_ADDRESS}/$1")?

<!-- gh-comment-id:2890690029 --> @monochromec commented on GitHub (May 19, 2025): Still not working with the configuration outlined [above](https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/800#issuecomment-2871325115). Also: Is the websocket URL correct (`"wss://${DS_ADDRESS}/$1"` instead of `"ws://${DS_ADDRESS}/$1"`)?
Author
Owner

@monochromec commented on GitHub (May 19, 2025):

Closing this as my 30-days trial period seems to be over (I wasn't aware that of this constraint). Unfortunately this renders OnlyOffice unfit for production deployment as there's a 100% FLOSS policy in place for this project environmen. Meaning that only software can be used which is free software in the original / OSI meaning (and that specifically excludes all components with license restrictions such as this one).

<!-- gh-comment-id:2890719921 --> @monochromec commented on GitHub (May 19, 2025): Closing this as my 30-days trial period seems to be over (I wasn't aware that of this constraint). Unfortunately this renders OnlyOffice unfit for production deployment as there's a 100% FLOSS policy in place for this project environmen. Meaning that only software can be used which is free software in the original / OSI meaning (and that specifically excludes all components with license restrictions such as this one).
Author
Owner

@igwyd commented on GitHub (May 19, 2025):

@monochromec we have completely free distribution - community edition, more information onlyoffice-docs-editions. It's a pity that it didn't work for you, if you change your mind, come back.

<!-- gh-comment-id:2890796870 --> @igwyd commented on GitHub (May 19, 2025): @monochromec we have completely free distribution - community edition, more information [onlyoffice-docs-editions](https://github.com/ONLYOFFICE/DocumentServer?tab=readme-ov-file#onlyoffice-docs-editions). It's a pity that it didn't work for you, if you change your mind, come back.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Docker-DocumentServer-ONLYOFFICE#375
No description provided.