401 Unauthorized on callback/download endpoints + Apache reverse proxy configuration (Docker)

[olibout]

Hi everyone,

I’m having a persistent issue with ONLYOFFICE Document Server and I would really appreciate some help from the community, especially regarding Apache reverse proxy configuration.

Environment

• ONLYOFFICE Document Server running in Docker

• Backend app running on port 3000

• Reverse proxy with Apache + HTTPS

• Public domain (anonymized): docs.example.com

Main issue

The editor opens, but the document does not load/save correctly.

I consistently get 401 Unauthorized errors on both the callback and download endpoints.

Logs (anonymized)

Here are the exact relevant logs with document names anonymized:

[WARN] io.connection_error code=3, message=Bad request,
url=/doc/<DOCUMENT_KEY>/c/?shardkey=<DOCUMENT_KEY>&EIO=4&transport=websocket

[ERROR] postData error:
url = http://172.17.0.1:3000/onlyoffice-docs/documents/callback
data = {
  "key":"<DOCUMENT_KEY>",
  "status":1,
  "users":["1"],
  "actions":[{"type":1,"userid":"1"}],
  "token":"<JWT_TOKEN>"
}
AxiosError: Request failed with status code 401

[ERROR] error downloadFile:
url=http://172.17.0.1:3000/onlyoffice-docs/download/<DOCUMENT_NAME>
attempt=1
AxiosError: Request failed with status code 401

[ERROR] error downloadFile:
attempt=2
status code 401

[ERROR] error downloadFile:
attempt=3
status code 401

Important detail

I already removed all middleware / auth guards from my backend routes.

So I do not think this is caused by application middleware.

Even with no middleware, ONLYOFFICE still gets 401.

Apache reverse proxy config

I would also like feedback on my Apache proxy configuration, especially for WebSocket support.

Current config:

<VirtualHost *:443>
    ServerName docs.example.com

    SSLEngine on

    ProxyPreserveHost On
    SSLProxyEngine on

    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Ssl on

    ProxyPassMatch "^/(.*)/ws$" "ws://127.0.0.1:8080/$1/ws"
    ProxyPass "/doc/" "http://127.0.0.1:8080/doc/"
    ProxyPassReverse "/doc/" "http://127.0.0.1:8080/doc/"

    ProxyPass / "http://127.0.0.1:8080/"
    ProxyPassReverse / "http://127.0.0.1:8080/"

    SSLCertificateFile /path/to/fullchain.pem
    SSLCertificateKeyFile /path/to/privkey.pem
</VirtualHost>

Questions

1. Does this Apache reverse proxy config look correct for ONLYOFFICE?

2. Is there anything missing for WebSocket handling?

3. Could a proxy misconfiguration cause these repeated 401 responses?

4. Has anyone experienced similar issues with Docker + Apache?

At this point I am unsure whether the issue comes from:

• ONLYOFFICE JWT config

• backend callback validation

• Apache proxy / websocket config

Any advice would be greatly appreciated.

Thank you. to external storage)

[olibout]

I finally fixed the problem — it wasn’t OnlyOffice at all. A global route with authentication middleware was intercepting the requests and breaking the flow. Once I moved/adjusted it, everything worked fine. Thanks!

[Marix]

Hi, @olibout !

Thank you for the detailed description and for the follow‑up update.
We are glad to hear that you found the root cause and everything works fine now!

I’ll close this topic.

If you have any further questions or face any issues in the future, please feel free to create a new thread on our forum!