I we have this problem that OnlyOffice uses HTTP instead of HTTPS in browser requests (reverse proxy) and i found this in github and see still it does not fixed and also i tried them and not works possible give me any solution for this ?
opened 10:26PM - 26 Mar 23 UTC
waiting feedback
### This issue is unique.
- [x] I have used the [search tool](https://github.… com/ONLYOFFICE/DocuemntServer/issues?q=) and did not find an issue describing my bug.
*Note:* This issue may be related to https://github.com/ONLYOFFICE/DocumentServer/issues/2083 because some of the errors seem similar, but there are also many other errors mentioned that I have not seen
### Operating System of DocumentServer
Docker
### Version information
v7.3.2.8 & v7.3.3.49
### Expected Behavior
I expected the request from the JS code in the web-browser to send requests using HTTPS not using HTTP.
**Note:** The browser connects to Nextcloud over HTTPS
I was unable to verify if this worked on older versions of OnlyOffice
### Actual Behavior
The JS code running in the browser send the request using HTTP, not HTTPS
**Note:** The browser connects to Nextcloud over HTTPS
### Reproduction Steps
1. Go to the Nextcloud instance in the web-browser
2. Create a "New spreadsheet" file
3. Click on the "New spreadsheet.xlsx" file to open it, see screenshot
4. Now you will see the error message from OnlyOffice, see the screenshot
5. If you open the browser console, you will see that the error saying that the content is blocked because you try to load content from both HTTP and HTTPS (seems to be a security policy enabled by something in a header or metadata on an HTML page - [Learn More](https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content)).
```
Blocked loading mixed active content “http://onlyoffice.EXAMPLE.COM/cache/files/data/3304616191/Editor.bin/Editor.bin?md5=EV5BqECOklqjXAMkT6PXCg&expires=1682113345&filename=Editor.bin”
```
6. If we go to the source code, by clicking on `sdk-all-min.js:512:36` (or `sdk-all-min.js:formatted:14179` if you have selected "Pretty print source") and set a breakpoint and retry the hole think we will get something looking like the following screenshot
7. In the screenshot we can see that the URL for the variable `Wb` is HTTP and not HTTPS and that is there the problem lies, changing the `http://` to `https://` resolves the problem.
I really hope this can help someone track down and fix this bug.
### Additional information
## Setup
**Docker setup files:** [onlyoffice_bug.zip](https://github.com/ONLYOFFICE/DocumentServer/files/11073207/onlyoffice_bug.zip)
1. `cd` into the folder from the unpacked zip-file
2. Run the command to start Traefik
```bash
docker-compose -f traefik-docker/docker-compose.yml up -d
```
3. Config the `DOMAIN_BASE` variable for in `nextcloud-docker/.env`
4. Run the command to start Nextcloud with OnlyOffice
```bash
docker-compose -f nextcloud-docker/docker-compose.yml up -d
```
5. Login to the Nextcloud setup
6. Install OnlyOffice App
7. Config Nextcloud according to the screenshot
## (Hacky) Workaround — The original way I tried to get around this
1. Run the following command
```
# Patch file
docker compose exec onlyoffice sed -E -i 's|(function +\w+\(\w+\) *\{ *function +\w+\(\)) *\{ *(\w+)\.open\((\w+),(\w+),(\w+)\);|\1{\nif (\4 \&\& \4.length > 5) {if (\4.substring(0, 5) == "http:") {\4 = \4.replace("http://", "https://");}};\n\2.open(\3,\4,\5);\n|' /var/www/onlyoffice/documentserver/sdkjs/cell/sdk-all-min.js
# Restart container
docker-compose restart onlyoffice
```
2. Clean all cached data for Nextcloud and OnlyOffice in your browser, or try with browser in private mode.
3. Now everything should work for spreadsheet files, but if you want it to work for document- & presentation-files you also need to patch `/var/www/onlyoffice/documentserver/sdkjs/word/sdk-all-min.js` and `/var/www/onlyoffice/documentserver/sdkjs/word/sdk-all-min.js`.
## (Update) Workaround — The better way to work around this
Added the header `Content-Security-Policy` with `upgrade-insecure-requests` to the config for your chosen reverse proxy.
Thanks to @Cryxto for the solutions: https://github.com/ONLYOFFICE/DocumentServer/issues/2186#issuecomment-1673182604
I also updated the [docker-compose.yml](https://github.com/ONLYOFFICE/DocumentServer/files/12328467/docker-compose.yml.txt) so Traefik will apply the workaround: https://github.com/ONLYOFFICE/DocumentServer/issues/2186#issuecomment-1676150397
## Showing that the `X-Forwarded-*` headers are set by the reverse proxy
The IP of:
- The docker subnet gateway: 172.18.0.1
- OnlyOffice container: 172.18.0.2
- The server IP (Real IP): 192.168.1.131
I am using Traefik as the reverse-proxy/ssl off-loading, so to make sure that Traefik sets the `X-Forwarded-*` headers I used Wireshark to capture the decrypted trafic between Traefik and the OnlyOffice container.
Hello @srpsadid OnlyOffice uses HTTP instead of HTTPS in browser requests (reverse proxy) · Issue #2186 · ONLYOFFICE/DocumentServer · GitHub Using ONLYOFFICE Docs behind the proxy
Please let us know if it has resolved the situation or provide us with additional details on the situation.