Environment:
- Nextcloud version: 34.0.0
- Document Server version: 9.4.1.15
- Type of installation of the Document Server (docker, deb/rpm, exe, please point us to the installation guide that you used as well): onlyoffice/documentserver-ee:latest
- Connector version: 10.1.0
- DMS (platform) version: ?
- OS: Debia
- Browser version: Firefox 149.0.2
Additional information:
When I’m entering credentials in the connector in Nextcloud I get the following error in a toast within the settings screen:
“Error when trying to connect (Error occurred in the document service: Error while downloading the document file to be converted.) (version 9.4.1.15)”
When I look in the logs I see these errors:
“Download empty without jwt“
“ExceptionError occurred in the document service: Error while downloading the document file to be converted.“
In the hopes that anyone can assist in troubleshooting I have found the following information in my OnlyOffice logs when I click “Save” in the Nextcloud OnlyOffice connector settings
```
…
onlyoffice | [2026-06-25T17:10:38.735] [DEBUG] [localhost] [docId] [userId] nodeJS - checkJwt success: decoded = {“async”:false,“url”:“https://[redacted]/apps/onlyoffice/empty?doc=[hash]”,“outputtype”:“docx”,“filetype”:“docx”,“title”:“check_284717562.docx”,“key”:“check_284717562”,“iat”:1782407438,“exp”:1782407738}
onlyoffice | [2026-06-25T17:10:38.735] [DEBUG] [localhost] [check_284717562] [userId] nodeJS - Start convert request
onlyoffice |
onlyoffice | ==> /var/log/onlyoffice/documentserver/converter/out.log <==
onlyoffice | [2026-06-25T17:10:38.751] [INFO] [localhost] [check_284717562] [userId] nodeJS - Start Task
onlyoffice | [2026-06-25T17:10:38.763] [DEBUG] [localhost] [check_284717562] [userId] nodeJS - isAllowDirectRequest url in jwt token res=true
onlyoffice | [2026-06-25T17:10:38.958] [ERROR] [localhost] [check_284717562] [userId] nodeJS - error downloadFile:url=https://[redacted]/apps/onlyoffice/empty?doc=[hash];attempt=1;code:ERR_BAD_REQUEST;connect:undefined AxiosError: Request failed with status code 403
onlyoffice | at settle (/snapshot/server/Common/node_modules/axios/dist/node/axios.cjs)
onlyoffice | at RedirectableRequest.handleResponse (/snapshot/server/Common/node_modules/axios/dist/node/axios.cjs)
onlyoffice | at RedirectableRequest.emit (node:events:536:35)
onlyoffice | at RedirectableRequest._processResponse (/snapshot/server/Common/node_modules/follow-redirects/index.js:409:10)
onlyoffice | at ClientRequest. (/snapshot/server/Common/node_modules/follow-redirects/index.js:102:12)
onlyoffice | at Object.onceWrapper (node:events:639:26)
onlyoffice | at ClientRequest.emit (node:events:524:28)
onlyoffice | at HTTPParser.parserOnIncomingClient (node:_http_client:702:27)
onlyoffice | at HTTPParser.parserOnHeadersComplete (node:_http_common:118:17)
onlyoffice | at TLSSocket.socketOnData (node:_http_client:544:22)
onlyoffice | at Axios.request (/snapshot/server/Common/node_modules/axios/dist/node/axios.cjs)
onlyoffice | at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
onlyoffice | at async Object.downloadUrlPromise (/snapshot/server/Common/sources/utils.js)
onlyoffice | [2026-06-25T17:10:39.959] [DEBUG] [localhost] [check_284717562] [userId] nodeJS - isAllowDirectRequest url in jwt token res=true
…
```
Hi @matrixes, welcome to the community!
Your logs show that JWT validation on the Document Server side succeeds, but the request back to Nextcloud to download the test file is rejected with a 403 Forbidden. This typically happens when a reverse proxy in front of Nextcloud strips or blocks the Authorization header before it reaches the Nextcloud app.
Could you share your network setup — specifically, is there a reverse proxy (nginx, Apache, Caddy, etc.) in front of your Nextcloud instance? And are Document Server and Nextcloud running on the same host or on separate machines?
In the meantime, you can try a quick test from inside the Document Server container to confirm connectivity:
curl -v https://YOUR_NEXTCLOUD_URL/status.php
Let’s see if we can iron this out. Here’s a few details that hopefully helps
nginx-proxy
nextcloud-conf
server {
server_name nextcloud;
client_max_body_size 512M;
listen 443 ssl; # managed by Certbot
...
certs
...
fastcgi_read_timeout 120s;
location / {
proxy_read_timeout 120s;
proxy_pass http://nextcloud;
}
...
}
server {
if ($host = nextcloud) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name nextcloud;
}
onlyoffice-conf
server {
listen 443 ssl;
server_name onlyoffice;
...
certs
...
location / {
proxy_pass http://onlyoffice:1234;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
}
}
server {
if ($host = onlyoffice) {
return 301 https://$host$request_uri;
} # managed by Certbot
server_name onlyoffice;
client_max_body_size 512M;
}
Docker
Everything lives inside one docker-compose, both nextcloud and onlyoffice. They are not sharing the same network.
Connectivity
- I can access nextcloud through https://nextcloud
- I can access onlyoffice through https://onlyoffice (e.g. looking at the welcome page of onlyoffice. I can also access the admin pages)
- I can curl from onlyoffice docker container to nextcloud:
curl -v https://nextcloud/status.php outputs a lot of details and on first inspection it looks normal.
Hi @matrixes,
Thanks for sharing your nginx configs — that confirms the issue.
Your Nextcloud location / block is missing proxy_set_header directives. The Document Server sends the JWT in the Authorization header, but your proxy isn’t forwarding it to Nextcloud — so Nextcloud sees a request without a valid token and returns 403. (Notice your ONLYOFFICE block already has proper headers, but the Nextcloud one doesn’t.)
Try updating your Nextcloud location / block like this:
nginx
location / {
proxy_read_timeout 120s;
proxy_pass http://nextcloud;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Authorization $http_authorization;
}
Then reload nginx (nginx -s reload) and try saving the connector settings again.
For reference:
Let us know how it goes.
1 Like
There we go!
I had done a lot of troubleshooting following different guides and had at one point set JWT_HEADER=AuthorizationJwt which got lost in the mix of everything else I tried.
I set this back to the default value and everything finally started clicking into place.
Thanks for the support and direction!
1 Like
Great to hear it’s resolved! That leftover JWT_HEADER setting is a common gotcha.
Feel free to stick around — your experience here can help others facing the same issue down the line. 