starred/nginx-proxy-manager-NginxProxyManager

Fork 0

mirror of https://github.com/NginxProxyManager/nginx-proxy-manager.git synced 2026-04-25 09:25:55 +03:00

[GH-ISSUE #4484] Opencloud / Owncloud: can not open password protected shared file #2873

New issue

Closed

opened 2026-02-26 07:37:03 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 07:37:03 +03:00

Owner

Originally created by @cscholz on GitHub (Apr 13, 2025).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4484

Checklist

Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
- Yes
Are you sure you're not using someone else's docker image?
- Yes
Have you searched for similar issues (both open and closed)?
- Yes

Describe the bug
I'm using npm to access opencloud (owncloud ocis). Everything works execpt accessing a passwort protected file. A not password protect file is accessable.

I'was able to identifiy, that when using plain nginx with minimal config. password enabled files are accessable

Nginx Proxy Manager Version
v2.12.3 © 2024 [jc21.com]

To Reproduce
Steps to reproduce the behavior:

create docker compose to setup opencloud minimal

name: opencloud01
services:
  opencloud:
    command:
      - -c
      - opencloud init || true; opencloud server
    entrypoint:
      - /bin/sh
    environment:
      COLLABORA_DOMAIN: collabora.domain.tld
      COMPANION_DOMAIN: companion.domain.tld
      GATEWAY_GRPC_ADDR: 0.0.0.0:9142
      IDM_ADMIN_PASSWORD: notSecure
      IDM_CREATE_DEMO_USERS: "false"
      MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233
      NATS_NATS_HOST: 0.0.0.0
      NATS_NATS_PORT: "9233"
      OC_INSECURE: "false"
      OC_LOG_COLOR: "true"
      OC_LOG_LEVEL: info
      OC_LOG_PRETTY: "true"
      OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
      OC_URL: https://oc.domain.tld
      ONLYOFFICE_DOMAIN: onlyoffice.domain.tld
      KEYCLOAK_DOMAIN: auth.domain.tld
      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
      PROXY_ENABLE_BASIC_AUTH: "true"
      PROXY_TLS: "false"
    image: docker.io/opencloudeu/opencloud-rolling:2.0.0
    container_name: oc-test.app
    networks:
      opencloud-net: null
    ports:
      - 9200:9200
    restart: always
    volumes:
      - type: bind
        source: /docker/opencloud/config/opencloud/app-registry.yaml
        # https://raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/app-registry.yaml
        target: /etc/opencloud/app-registry.yaml
        read_only: true
        bind:
          create_host_path: true
      - type: bind
        source: /docker/opencloud/config/opencloud/csp.yaml
        # https://[raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/csp.yaml](https://raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/csp.yaml)
        target: /etc/opencloud/csp.yaml
        read_only: true
        bind:
          create_host_path: true
      - type: bind
        source: /docker/opencloud/config/opencloud/banned-password-list.txt
        # https://[raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/banned-password-list.txt](https://raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/banned-password-list.txt)
        target: /etc/opencloud/banned-password-list.txt
        read_only: true
        bind:
          create_host_path: true
      - type: volume
        source: opencloud-config
        target: /etc/opencloud
        volume: {}
      - type: volume
        source: opencloud-data
        target: /var/lib/opencloud
        volume: {}
      - type: volume
        source: opencloud-apps
        target: /var/lib/opencloud/web/assets/apps
        volume: {}
networks:
  opencloud-net:
    name: opencloud01_opencloud-net
volumes:
  opencloud-apps:
    name: opencloud01_opencloud-apps
  opencloud-config:
    name: opencloud01_opencloud-config
  opencloud-data:
    name: opencloud01_opencloud-data

Login as admin/notSecure
Create or upload a file. Share the file and make sure the link is password protected
See docker logs
2025-04-13T22:15:31+02:00 ERR invalid transfer token error="datagateway: error validating transfer token: error parsing token: token is malformed: token contains an invalid number of segments" line=github.com/opencloud-eu/reva/v2@v2.31.0/internal/http/services/datagateway/datagateway.go:170 pkg=rhttp request-id=1e13d6e9-36b1-42ef-8f3a-7b33796c0446 service=frontend token=custom_404.html traceid=82e9d2667513ad4662b49cc6ac0c6417

Expected behavior
Password protected link should work

plain nginx config working

worker_processes  1;

events {
  worker_connections  1024;
}

http {
  server {
    listen 80;
    listen [::]:80;

    listen 443 ssl;
    listen [::]:443 ssl;

    http2 on;

    server_name oc.domain.tld;

    # Custom SSL
    ssl_certificate /ssl/cert.pem;
    ssl_certificate_key /ssl/key.pem;

    access_log /dev/stdout;
    error_log /dev/stdout info;

    large_client_header_buffers 4 16k;

    location / {
        # OIDC Tokens in headers are quite large and can exceed default limits of reverse proxies
        proxy_buffers 4 256k;
        proxy_buffer_size 128k;
        proxy_busy_buffers_size 256k;

        # Disable checking of client request body size
        client_max_body_size 0;

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto  $scheme;
        proxy_set_header X-Forwarded-For    $remote_addr;
        proxy_set_header X-Real-IP          $remote_addr;

        proxy_pass       http://127.0.0.1:9200;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_http_version 1.1;
    }
  }
}

Operating System

lsb_release  -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 12 (bookworm)
Release:        12
Codename:       bookworm

Additional context

Originally created by @cscholz on GitHub (Apr 13, 2025). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/4484  **Checklist** - Have you pulled and found the error with `jc21/nginx-proxy-manager:latest` docker image? - Yes - Are you sure you're not using someone else's docker image? - Yes - Have you searched for similar issues (both open and closed)? - Yes **Describe the bug** I'm using npm to access opencloud (owncloud ocis). Everything works execpt accessing a passwort protected file. A not password protect file is accessable. I'was able to identifiy, that when using plain nginx with minimal config. password enabled files are accessable **Nginx Proxy Manager Version** v2.12.3 © 2024 [jc21.com] **To Reproduce** Steps to reproduce the behavior: 1. create docker compose to setup opencloud minimal ``` name: opencloud01 services: opencloud: command: - -c - opencloud init || true; opencloud server entrypoint: - /bin/sh environment: COLLABORA_DOMAIN: collabora.domain.tld COMPANION_DOMAIN: companion.domain.tld GATEWAY_GRPC_ADDR: 0.0.0.0:9142 IDM_ADMIN_PASSWORD: notSecure IDM_CREATE_DEMO_USERS: "false" MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233 NATS_NATS_HOST: 0.0.0.0 NATS_NATS_PORT: "9233" OC_INSECURE: "false" OC_LOG_COLOR: "true" OC_LOG_LEVEL: info OC_LOG_PRETTY: "true" OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt OC_URL: https://oc.domain.tld ONLYOFFICE_DOMAIN: onlyoffice.domain.tld KEYCLOAK_DOMAIN: auth.domain.tld PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml PROXY_ENABLE_BASIC_AUTH: "true" PROXY_TLS: "false" image: docker.io/opencloudeu/opencloud-rolling:2.0.0 container_name: oc-test.app networks: opencloud-net: null ports: - 9200:9200 restart: always volumes: - type: bind source: /docker/opencloud/config/opencloud/app-registry.yaml # https://raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/app-registry.yaml target: /etc/opencloud/app-registry.yaml read_only: true bind: create_host_path: true - type: bind source: /docker/opencloud/config/opencloud/csp.yaml # https://[raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/csp.yaml](https://raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/csp.yaml) target: /etc/opencloud/csp.yaml read_only: true bind: create_host_path: true - type: bind source: /docker/opencloud/config/opencloud/banned-password-list.txt # https://[raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/banned-password-list.txt](https://raw.githubusercontent.com/opencloud-eu/opencloud/refs/heads/main/deployments/examples/opencloud_full/config/opencloud/banned-password-list.txt) target: /etc/opencloud/banned-password-list.txt read_only: true bind: create_host_path: true - type: volume source: opencloud-config target: /etc/opencloud volume: {} - type: volume source: opencloud-data target: /var/lib/opencloud volume: {} - type: volume source: opencloud-apps target: /var/lib/opencloud/web/assets/apps volume: {} networks: opencloud-net: name: opencloud01_opencloud-net volumes: opencloud-apps: name: opencloud01_opencloud-apps opencloud-config: name: opencloud01_opencloud-config opencloud-data: name: opencloud01_opencloud-data ``` 2. Login as admin/notSecure 3. Create or upload a file. Share the file and make sure the link is password protected 4. See docker logs `2025-04-13T22:15:31+02:00` ERR invalid transfer token error="datagateway: error validating transfer token: error parsing token: token is malformed: token contains an invalid number of segments" line=github.com/opencloud-eu/reva/v2@v2.31.0/internal/http/services/datagateway/datagateway.go:170 pkg=rhttp request-id=1e13d6e9-36b1-42ef-8f3a-7b33796c0446 service=frontend token=custom_404.html traceid=82e9d2667513ad4662b49cc6ac0c6417 **Expected behavior** Password protected link should work **plain nginx config working** ``` worker_processes 1; events { worker_connections 1024; } http { server { listen 80; listen [::]:80; listen 443 ssl; listen [::]:443 ssl; http2 on; server_name oc.domain.tld; # Custom SSL ssl_certificate /ssl/cert.pem; ssl_certificate_key /ssl/key.pem; access_log /dev/stdout; error_log /dev/stdout info; large_client_header_buffers 4 16k; location / { # OIDC Tokens in headers are quite large and can exceed default limits of reverse proxies proxy_buffers 4 256k; proxy_buffer_size 128k; proxy_busy_buffers_size 256k; # Disable checking of client request body size client_max_body_size 0; proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://127.0.0.1:9200; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; } } } ``` **Operating System** ``` lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 12 (bookworm) Release: 12 Codename: bookworm ``` **Additional context**

kerem

2026-02-26 07:37:03 +03:00

closed this issue
added the
bug
label

kerem commented

2026-02-26 07:37:03 +03:00

Author

Owner

@cscholz commented on GitHub (Apr 14, 2025):

Issue found. Needed to set proxy_intercept_errors to off in the location section of npm.

To help others, following parameter are working for me in a custom location for /:

proxy_intercept_errors off;

# OIDC Tokens in headers are quite large and can exceed default limits of reverse proxies
proxy_buffers 2 128k;
proxy_buffer_size 64k;
proxy_busy_buffers_size 128k;

# Disable checking of client request body size
client_max_body_size 0;

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;

@cscholz commented on GitHub (Apr 14, 2025): Issue found. Needed to set **proxy_intercept_errors** to off in the location section of npm. To help others, following parameter are working for me in a custom location for /: ``` proxy_intercept_errors off; # OIDC Tokens in headers are quite large and can exceed default limits of reverse proxies proxy_buffers 2 128k; proxy_buffer_size 64k; proxy_busy_buffers_size 128k; # Disable checking of client request body size client_max_body_size 0; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; ```

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/nginx-proxy-manager-NginxProxyManager#2873

No description provided.

Rows
Columns