[GH-ISSUE #810] document server generate http:// url when running behind https-to-http reverse proxy #381

Closed
opened 2026-02-26 10:32:16 +03:00 by kerem · 6 comments
Owner

Originally created by @schplurtz on GitHub (May 10, 2025).
Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/810

Bug report general description

_ _
type bug report
description file won't open in editor
expected behaviour file will open in editor
fresh installation  yes
Docker image onlyoffice/documentserver:latest
docker version Docker version 28.1.1, build 4eba377, from https://docs.docker.com/engine/install/ubuntu/
host ubuntu 24.04.2 on arm64, ubuntu is up to date

I have traefik as a reverse proxy. It handles incoming HTTPS communication
and communicates with docker apps over HTTP.

I use seafile(freshly installed too) as cloud solution and I want to use
onlyoffice as a plugin for seafile. The setup uses what is described as
Virtual Path on onlyoffice documentation.

Here is the situation:

         .----------.
         | traefik  | / => /       .-------------------.
         |          |------------->| docker seafile    |
 HTTPS-->|          |    HTTP      |                   |
         |          |              '-------------------'
         |          |              .-------------------.
         |          | /oods => /   | docker onlyoffice |
         |          |------------->| document server   |
         '----------'    HTTP      '-------------------'

The problem

All the communication between browser and traefik server happens over HTTPS.
Everything is setup correctly. I converted the given toml configuration to docker
labels.

When I want to open a docx document from seafile, the UI loads, but the
document itself wont load. The reason is the browser is instructed to load
the document over HTTP, which of course, it refuses to do, as shown on
the screenshot.

Image

analyse

To get an idea of what is happening, I entered the onlyoffice docker container
apt-get-installed tcpdump, and captured packets between traefik and the
container. I can provide you with the full network dump if you wish. Below,
I reproduced 3 parts of the capture:

  1. first paquet, that shows everything works as it should
  2. the connexion upgrade to WSS websocket
  3. the problematic message from onlyoffice that instructs to use HTTP

1) first packet capture

GET /web-apps/apps/api/documents/api.js HTTP/1.1
Host: truc.bidule.https443.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0
Accept: */*
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Cookie: sfcsrftoken=J4TbRKriBlfMDwx1l3yVEhTLFrYAMKzf; sessionid=0ld9vpjjlf5fffyz1f7wzip0762c2asd
Dnt: 1
Referer: https://truc.bidule.https443.net/lib/ef9b3bb6-ee90-4954-870b-a14c7ad2937e/file/mots.docx
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Sec-Gpc: 1
Te: trailers
X-Forwarded-For: 192.168.255.1
X-Forwarded-Host: truc.bidule.https443.net/oods
X-Forwarded-Port: 443
X-Forwarded-Proto: https
X-Forwarded-Server: leela
X-Real-Ip: 192.168.255.1


HTTP/1.1 200 OK
Server: nginx
Date: Sat, 10 May 2025 06:53:52 GMT
Content-Type: application/javascript
Content-Length: 12332
Last-Modified: Sat, 10 May 2025 06:50:32 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "681ef738-302c"
Content-Encoding: gzip
Expires: Sat, 10 May 2025 06:53:51 GMT
Cache-Control: no-cache
Accept-Ranges: bytes

Here we can see that:

  • traefik correctly removed /oods prefix
  • traefik adds all the needed X-forwarded-* headers
  • The seafile referer also uses https on the same host

2) connexion upgrade to WSS websocket

GET /8.3.3-f5152210d562557fcdfa43ef1a2fd265/doc/50d718b6105ae8d19f0e/c/?shardkey=50d718b6105ae8d19f0e&EIO=4&transport=websocket HTTP/1.1
Host: truc.bidule.https443.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0
Accept: */*
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Cache-Control: no-cache
Connection: Upgrade
Cookie: sfcsrftoken=J4TbRKriBlfMDwx1l3yVEhTLFrYAMKzf; sessionid=0ld9vpjjlf5fffyz1f7wzip0762c2asd
Dnt: 1
Origin: https://truc.bidule.https443.net
Pragma: no-cache
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-origin
Sec-Gpc: 1
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: /BUcHqPaVnHKZsPA1K2+4g==
Sec-WebSocket-Version: 13
Upgrade: websocket
X-Forwarded-For: 192.168.255.1
X-Forwarded-Host: truc.bidule.https443.net/oods
X-Forwarded-Port: 443
X-Forwarded-Proto: wss
X-Forwarded-Server: leela
X-Real-Ip: 192.168.255.1


HTTP/1.1 101 Switching Protocols
Server: nginx
Date: Sat, 10 May 2025 06:53:59 GMT
Connection: upgrade
Upgrade: websocket
Sec-WebSocket-Accept: 12lizQC5Wswdc++T09tHt/OcJvk=

Traefik handles the change nicely, browser and only office server
behave correctly.

3) problematic message from onlyoffice that instructs to use HTTP

Within the websocket, I noticed this documentOpen message from
onlyoffice to the browser. I simply reformatted the JSON message with jq
for readability purposes.

[
  "message",
  {
    "type": "documentOpen",
    "data": {
      "type": "open",
      "status": "ok",
      "data": {
        "Editor.bin": "http://truc.bidule.https443.net/oods/cache/files/data/50d718b6105ae8d19f0e/Editor.bin/Editor.bin?md5=nzRKaE__bmGbUx7BFg2S9A&expires=1749454636&shardkey=50d718b6105ae8d19f0e&filename=Editor.bin"
      },
      "openedAt": 1746867243437
    }
  }
]
Originally created by @schplurtz on GitHub (May 10, 2025). Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/810 ## Bug report general description ## |_|_| |--|--| | type | bug report | | description | file won't open in editor | | expected behaviour | file will open in editor | | fresh installation | yes | | Docker image | `onlyoffice/documentserver:latest` | | docker version | `Docker version 28.1.1, build 4eba377`, from https://docs.docker.com/engine/install/ubuntu/ | | host | ubuntu 24.04.2 on arm64, ubuntu is up to date | I have traefik as a reverse proxy. It handles incoming HTTPS communication and communicates with docker apps over HTTP. I use [seafile](https://www.seafile.com/en/home/)(freshly installed too) as cloud solution and I want to use onlyoffice as a plugin for seafile. The setup uses what is described as [Virtual Path on onlyoffice documentation](https://helpcenter.onlyoffice.com/docs/installation/docs-community-proxy.aspx). Here is the situation: ``` .----------. | traefik | / => / .-------------------. | |------------->| docker seafile | HTTPS-->| | HTTP | | | | '-------------------' | | .-------------------. | | /oods => / | docker onlyoffice | | |------------->| document server | '----------' HTTP '-------------------' ``` ## The problem ## All the communication between browser and traefik server happens over HTTPS. Everything is setup correctly. I converted the given [toml configuration](https://github.com/ONLYOFFICE/document-server-proxy/blob/master/traefik/proxy-to-virtual-path.toml) to docker labels. When I want to open a docx document from seafile, the UI loads, but the document itself wont load. The reason is the browser is instructed to load the document over HTTP, which of course, it refuses to do, as shown on the screenshot. ![Image](https://github.com/user-attachments/assets/0e856d24-9f6d-4990-ac5b-a6184983f22c) ## analyse ## To get an idea of what is happening, I entered the onlyoffice docker container apt-get-installed tcpdump, and captured packets between traefik and the container. I can provide you with the full network dump if you wish. Below, I reproduced 3 parts of the capture: 1. first paquet, that shows everything works as it should 2. the connexion upgrade to WSS websocket 3. the problematic message from onlyoffice that instructs to use HTTP ### 1) first packet capture ### ``` GET /web-apps/apps/api/documents/api.js HTTP/1.1 Host: truc.bidule.https443.net User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0 Accept: */* Accept-Encoding: gzip, deflate, br, zstd Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Cookie: sfcsrftoken=J4TbRKriBlfMDwx1l3yVEhTLFrYAMKzf; sessionid=0ld9vpjjlf5fffyz1f7wzip0762c2asd Dnt: 1 Referer: https://truc.bidule.https443.net/lib/ef9b3bb6-ee90-4954-870b-a14c7ad2937e/file/mots.docx Sec-Fetch-Dest: script Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Sec-Gpc: 1 Te: trailers X-Forwarded-For: 192.168.255.1 X-Forwarded-Host: truc.bidule.https443.net/oods X-Forwarded-Port: 443 X-Forwarded-Proto: https X-Forwarded-Server: leela X-Real-Ip: 192.168.255.1 HTTP/1.1 200 OK Server: nginx Date: Sat, 10 May 2025 06:53:52 GMT Content-Type: application/javascript Content-Length: 12332 Last-Modified: Sat, 10 May 2025 06:50:32 GMT Connection: keep-alive Vary: Accept-Encoding ETag: "681ef738-302c" Content-Encoding: gzip Expires: Sat, 10 May 2025 06:53:51 GMT Cache-Control: no-cache Accept-Ranges: bytes ``` Here we can see that: * traefik correctly removed `/oods` prefix * traefik adds all the needed `X-forwarded-*` headers * The seafile referer also uses https on the same host ### 2) connexion upgrade to WSS websocket ### ``` GET /8.3.3-f5152210d562557fcdfa43ef1a2fd265/doc/50d718b6105ae8d19f0e/c/?shardkey=50d718b6105ae8d19f0e&EIO=4&transport=websocket HTTP/1.1 Host: truc.bidule.https443.net User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:138.0) Gecko/20100101 Firefox/138.0 Accept: */* Accept-Encoding: gzip, deflate, br, zstd Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3 Cache-Control: no-cache Connection: Upgrade Cookie: sfcsrftoken=J4TbRKriBlfMDwx1l3yVEhTLFrYAMKzf; sessionid=0ld9vpjjlf5fffyz1f7wzip0762c2asd Dnt: 1 Origin: https://truc.bidule.https443.net Pragma: no-cache Sec-Fetch-Dest: empty Sec-Fetch-Mode: websocket Sec-Fetch-Site: same-origin Sec-Gpc: 1 Sec-WebSocket-Extensions: permessage-deflate Sec-WebSocket-Key: /BUcHqPaVnHKZsPA1K2+4g== Sec-WebSocket-Version: 13 Upgrade: websocket X-Forwarded-For: 192.168.255.1 X-Forwarded-Host: truc.bidule.https443.net/oods X-Forwarded-Port: 443 X-Forwarded-Proto: wss X-Forwarded-Server: leela X-Real-Ip: 192.168.255.1 HTTP/1.1 101 Switching Protocols Server: nginx Date: Sat, 10 May 2025 06:53:59 GMT Connection: upgrade Upgrade: websocket Sec-WebSocket-Accept: 12lizQC5Wswdc++T09tHt/OcJvk= ``` Traefik handles the change nicely, browser and only office server behave correctly. ### 3) problematic message from onlyoffice that instructs to use HTTP Within the websocket, I noticed this **documentOpen** message from onlyoffice to the browser. I simply reformatted the JSON message with jq for readability purposes. ```JSON [ "message", { "type": "documentOpen", "data": { "type": "open", "status": "ok", "data": { "Editor.bin": "http://truc.bidule.https443.net/oods/cache/files/data/50d718b6105ae8d19f0e/Editor.bin/Editor.bin?md5=nzRKaE__bmGbUx7BFg2S9A&expires=1749454636&shardkey=50d718b6105ae8d19f0e&filename=Editor.bin" }, "openedAt": 1746867243437 } } ] ```
kerem 2026-02-26 10:32:16 +03:00
  • closed this issue
  • added the
    duplicate
    label
Author
Owner

@igwyd commented on GitHub (May 12, 2025):

Hello @schplurtz, unfortunately we still don't have actual configusration for the traefik proxy https://github.com/ONLYOFFICE/DocumentServer/issues/2162. Adding X-Forwarded-Proto header must solve this, for my environment it looks like this:

      - "traefik.http.routers.ds-web.middlewares=onlyoffice-headers"
      - "traefik.http.middlewares.onlyoffice-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.onlyoffice-headers.headers.accessControlAllowOrigin=*"
<!-- gh-comment-id:2870984639 --> @igwyd commented on GitHub (May 12, 2025): Hello @schplurtz, unfortunately we still don't have actual configusration for the traefik proxy https://github.com/ONLYOFFICE/DocumentServer/issues/2162. Adding `X-Forwarded-Proto` header must solve this, for my environment it looks like this: ``` - "traefik.http.routers.ds-web.middlewares=onlyoffice-headers" - "traefik.http.middlewares.onlyoffice-headers.headers.customrequestheaders.X-Forwarded-Proto=https" - "traefik.http.middlewares.onlyoffice-headers.headers.accessControlAllowOrigin=*" ```
Author
Owner

@schplurtz commented on GitHub (May 13, 2025):

@Rita-Bubnova this is not a duplicate. #2162 is about "double prefix". This is about Onlyoffice suddenly swiching from HTTPS to HTTP.

Please, reopen

I was hit by the "double prefix" problem but solved it quickly by removing the X-forward-prefix header. Please, have a look at the first tcpdump.

<!-- gh-comment-id:2875270711 --> @schplurtz commented on GitHub (May 13, 2025): @Rita-Bubnova this is **not** a duplicate. #2162 is about "double prefix". This is about Onlyoffice suddenly swiching from HTTPS to HTTP. Please, reopen I was hit by the "double prefix" problem but solved it quickly by removing the X-forward-prefix header. Please, have a look at the first tcpdump.
Author
Owner

@igwyd commented on GitHub (May 13, 2025):

@schplurtz but this is the same issue with the lack of a work configs for the actual version of traefik proxy. Bug in the https://github.com/ONLYOFFICE/DocumentServer/issues/2162 about it.

<!-- gh-comment-id:2875334131 --> @igwyd commented on GitHub (May 13, 2025): @schplurtz but this is the same issue with the lack of a work configs for the actual version of traefik proxy. Bug in the https://github.com/ONLYOFFICE/DocumentServer/issues/2162 about it.
Author
Owner

@schplurtz commented on GitHub (May 13, 2025):

@schplurtz but this is the same issue with the lack of a work configs for the actual version of traefik proxy. Bug in the ONLYOFFICE/DocumentServer#2162 about it.

thanks for answering @igwyd. But I fail to see the logic here. There is clearly some kind of problem in ONLYOFFICE/DocumentServer#2162 related to "prefix doubling", which original poster sorted out by removing the X-forwarded-prefix header (as I did), and a problem with the onlyoffice emitting HTTP URL while the communication happens over HTTPS (and there are x-forwarded-proto headers in my config).

Is the fact that the both of #2162 OP and me use traefik the reason for considering the bugs duplicate ?

<!-- gh-comment-id:2875377206 --> @schplurtz commented on GitHub (May 13, 2025): > [@schplurtz](https://github.com/schplurtz) but this is the same issue with the lack of a work configs for the actual version of traefik proxy. Bug in the [ONLYOFFICE/DocumentServer#2162](https://github.com/ONLYOFFICE/DocumentServer/issues/2162) about it. thanks for answering @igwyd. But I fail to see the logic here. There is clearly some kind of problem in [ONLYOFFICE/DocumentServer#2162](https://github.com/ONLYOFFICE/DocumentServer/issues/2162) related to "prefix doubling", which original poster sorted out by removing the X-forwarded-prefix header (as I did), and a problem with the onlyoffice emitting HTTP URL while the communication happens over HTTPS (and there are x-forwarded-proto headers in my config). Is the fact that the both of [#2162](https://github.com/ONLYOFFICE/DocumentServer/issues/2162) OP and me use traefik the reason for considering the bugs duplicate ?
Author
Owner

@schplurtz commented on GitHub (May 13, 2025):

Hello @igwyd.

You are right and you solved this issue. Thanks a million!

The X-forwarded-proto header must be forced to https. As one can see in my network capture, traefik modifies the proto when the upgrade to websocket occurs. It uses the (standard ?) wss proto instead of https. forcing the header to https is the key. the accessControlAllowOrigin=* header is not needed in VPATH setup as everything happens on the same host. Anyway, problem solved!

<!-- gh-comment-id:2875521703 --> @schplurtz commented on GitHub (May 13, 2025): Hello @igwyd. You are right and you solved this issue. Thanks a million! The `X-forwarded-proto` header must be forced to https. As one can see in my network capture, traefik modifies the proto when the upgrade to websocket occurs. It uses the (standard ?) `wss` proto instead of `https`. forcing the header to `https` is the key. the `accessControlAllowOrigin=*` header is not needed in VPATH setup as everything happens on the same host. Anyway, problem solved!
Author
Owner

@schplurtz commented on GitHub (May 13, 2025):

solution

To make things clear, there are 2 problems identified:

  • Not my problem here but still an issue: prefix doubling (document server #2162). solved by removing the x-forwarded-prefix header.
  • switching to HTTP because of non-recognition of the wss protocol, solved by forcing X-forwarded-proto to https. Thanks again @igwyd.

My complete working traefik setup, in case it could help people

VPATH solution, with traefik accepting HTTPS and communicating with document server over HTTP.

---
# works in 2025.
# access via 'https://${SERVER_HOSTNAME}/oods/web-apps/apps/api/documents/api.js
# adapt variables in .env file and the certresolver (you probably don't use "certificatator")
# check the network part too

services:
  onlyoffice:
    image: ${ONLYOFFICE_IMAGE:-onlyoffice/documentserver:latest}
    restart: unless-stopped
    container_name: onlyoffice-ds
    environment:
      - JWT_ENABLED=true
      - JWT_SECRET=${ONLYOFFICE_JWT_SECRET:?Variable must be set in .env file}
      - GENERATE_FONTS:false
    volumes:
      - ${ONLYOFFICE_VOLUME:?Variable must be set in .env file}/logs:/var/log/onlyoffice
      - ${ONLYOFFICE_VOLUME:?Variable must be set in .env file}/data:/var/www/onlyoffice/Data
      - ${ONLYOFFICE_VOLUME:?Variable must be set in .env file}/lib:/var/lib/onlyoffice
    labels:
      - traefik.enable=true
      - traefik.http.routers.onlyoffice.rule=Host(`${SERVER_HOSTNAME?Variable must be set in .env file}`) && PathPrefix(`/oods/`)
      - traefik.http.routers.onlyoffice.middlewares=stripoods,oodsheaders
      - traefik.http.routers.onlyoffice.entrypoints=websecure
      - traefik.http.routers.onlyoffice.tls.certresolver=certificatator
      - traefik.http.services.onlyoffice.loadbalancer.server.port=80
      - traefik.http.middlewares.stripoods.stripprefix.prefixes=/oods
      - traefik.http.middlewares.oodsheaders.headers.customrequestheaders.X-FORWARDED-HOST=${SERVER_HOSTNAME}/oods
      - traefik.http.middlewares.oodsheaders.headers.customrequestheaders.X-FORWARDED-PREFIX=
      - traefik.http.middlewares.oodsheaders.headers.customrequestheaders.X-Forwarded-Proto=https
#    networks:
#      - cloudapp-net
#
#networks:
#  cloudapp-net:
#    name: cloudapp-net

Also you have to make sure your cloud app does not handle the /oods prefix. For example, for seafile I use something like that:

    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.seafile-service.rule=Host(`${SEAFILE_SERVER_HOSTNAME:?Variable is not set or empty}`)  && ! ( PathPrefix(`/sdoc-server/`) || PathPrefix(`/socket.io/`) || PathPrefix(`/oods/`) )"
      - bla bla bla other standard labels...
<!-- gh-comment-id:2875679141 --> @schplurtz commented on GitHub (May 13, 2025): # solution To make things clear, there are 2 problems identified: * Not my problem here but still an issue: prefix doubling ([document server #2162](https://github.com/ONLYOFFICE/DocumentServer/issues/2162)). solved by removing the `x-forwarded-prefix` header. * switching to HTTP because of non-recognition of the wss protocol, solved by forcing `X-forwarded-proto` to `https`. Thanks again @igwyd. My complete working traefik setup, in case it could help people [VPATH](https://helpcenter.onlyoffice.com/docs/installation/docs-community-proxy.aspx) solution, with traefik accepting HTTPS and communicating with document server over HTTP. ```YAML --- # works in 2025. # access via 'https://${SERVER_HOSTNAME}/oods/web-apps/apps/api/documents/api.js # adapt variables in .env file and the certresolver (you probably don't use "certificatator") # check the network part too services: onlyoffice: image: ${ONLYOFFICE_IMAGE:-onlyoffice/documentserver:latest} restart: unless-stopped container_name: onlyoffice-ds environment: - JWT_ENABLED=true - JWT_SECRET=${ONLYOFFICE_JWT_SECRET:?Variable must be set in .env file} - GENERATE_FONTS:false volumes: - ${ONLYOFFICE_VOLUME:?Variable must be set in .env file}/logs:/var/log/onlyoffice - ${ONLYOFFICE_VOLUME:?Variable must be set in .env file}/data:/var/www/onlyoffice/Data - ${ONLYOFFICE_VOLUME:?Variable must be set in .env file}/lib:/var/lib/onlyoffice labels: - traefik.enable=true - traefik.http.routers.onlyoffice.rule=Host(`${SERVER_HOSTNAME?Variable must be set in .env file}`) && PathPrefix(`/oods/`) - traefik.http.routers.onlyoffice.middlewares=stripoods,oodsheaders - traefik.http.routers.onlyoffice.entrypoints=websecure - traefik.http.routers.onlyoffice.tls.certresolver=certificatator - traefik.http.services.onlyoffice.loadbalancer.server.port=80 - traefik.http.middlewares.stripoods.stripprefix.prefixes=/oods - traefik.http.middlewares.oodsheaders.headers.customrequestheaders.X-FORWARDED-HOST=${SERVER_HOSTNAME}/oods - traefik.http.middlewares.oodsheaders.headers.customrequestheaders.X-FORWARDED-PREFIX= - traefik.http.middlewares.oodsheaders.headers.customrequestheaders.X-Forwarded-Proto=https # networks: # - cloudapp-net # #networks: # cloudapp-net: # name: cloudapp-net ``` Also you have to make sure your cloud app does not handle the `/oods` prefix. For example, for [seafile](https://www.seafile.com/en/home/) I use something like that: ``` labels: - "traefik.enable=true" - "traefik.http.routers.seafile-service.rule=Host(`${SEAFILE_SERVER_HOSTNAME:?Variable is not set or empty}`) && ! ( PathPrefix(`/sdoc-server/`) || PathPrefix(`/socket.io/`) || PathPrefix(`/oods/`) )" - bla bla bla other standard labels... ```
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Docker-DocumentServer-ONLYOFFICE#381
No description provided.