Repository navigation
[Bug]: enabling apps calls a http url despite accessed through https #51940
Description
⚠️ This issue respects the following points: ⚠️
- This is a bug, not a question or a configuration/webserver/proxy issue.
- This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
- Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
- I agree to follow Nextcloud's Code of Conduct.
Bug description
up to date nextcloud, running off the php-fpm docker compose stack
when I try and enable an app from the app store, I get the error;
Refused to connect to 'http://cloud.andersens.xyz/apps/files/' because it violates the following Content Security Policy directive: "connect-src 'self'".
if i disable CSP headers, I get the error;
Mixed Content: The page at 'https://cloud.andersens.xyz/settings/apps/disabled' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://cloud.andersens.xyz/apps/files/'. This request has been blocked; the content must be served over HTTPS.
so. somehow app enabling specifically gets http prepended instead of https.
docker exec -it --user www-data nextcloud_app php occ config:list system |grep overwrite
"overwrite.cli.url": "https:\/\/cloud.andersens.xyz",
"overwriteprotocol": "https",
"overwritehost": "cloud.andersens.xyz",
Steps to reproduce
- try and enable an app
- get error about the app making the server unstable
- see CSP or mixed content errors in browser console
Expected behavior
app enabling being possible in the webui
Nextcloud Server version
31
Operating system
Other
PHP engine version
None
Web server
Nginx
Database engine version
PostgreSQL
Is this bug present after an update or on a fresh install?
None
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
- Default user-backend (database)
- LDAP/ Active Directory
- SSO - SAML
- Other
Configuration report
{
"system": {
"memcache.local": "\\OC\\Memcache\\APCu",
"apps_paths": [
{
"path": "\/var\/www\/html\/apps",
"url": "\/apps",
"writable": false
},
{
"path": "\/var\/www\/html\/custom_apps",
"url": "\/custom_apps",
"writable": true
}
],
"memcache.distributed": "\\OC\\Memcache\\Redis",
"memcache.locking": "\\OC\\Memcache\\Redis",
"redis": {
"host": "***REMOVED SENSITIVE VALUE***",
"password": "***REMOVED SENSITIVE VALUE***",
"port": 6379
},
"trusted_proxies": "***REMOVED SENSITIVE VALUE***",
"upgrade.disable-web": true,
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"localhost",
"10.10.10.10:8080",
"cloud.andersens.xyz"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"dbtype": "pgsql",
"version": "31.0.2.1",
"overwrite.cli.url": "https:\/\/cloud.andersens.xyz",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"dbport": "",
"dbtableprefix": "oc_",
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"installed": true,
"instanceid": "***REMOVED SENSITIVE VALUE***",
"overwriteprotocol": "https",
"forbidden_filename_basenames": [
"con",
"prn",
"aux",
"nul",
"com0",
"com1",
"com2",
"com3",
"com4",
"com5",
"com6",
"com7",
"com8",
"com9",
"com\u00b9",
"com\u00b2",
"com\u00b3",
"lpt0",
"lpt1",
"lpt2",
"lpt3",
"lpt4",
"lpt5",
"lpt6",
"lpt7",
"lpt8",
"lpt9",
"lpt\u00b9",
"lpt\u00b2",
"lpt\u00b3"
],
"forbidden_filename_characters": [
"<",
">",
":",
"\"",
"|",
"?",
"*",
"\\",
"\/"
],
"forbidden_filename_extensions": [
" ",
".",
".filepart",
".part"
],
"maintenance": false,
"overwritehost": "cloud.andersens.xyz",
"mail_smtpmode": "smtp",
"mail_smtpauth": true,
"mail_sendmailmode": "smtp",
"mail_smtpsecure": "ssl",
"mail_smtphost": "***REMOVED SENSITIVE VALUE***",
"mail_smtpport": "465",
"mail_from_address": "***REMOVED SENSITIVE VALUE***",
"mail_domain": "***REMOVED SENSITIVE VALUE***",
"mail_smtpname": "***REMOVED SENSITIVE VALUE***",
"mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
"app_install_overwrite": []
}
}List of activated Apps
Nextcloud Signing status
Nextcloud Logs
Additional info
No response
Activity
norseghost commentedon Apr 5, 2025
just did a clean reinstall from my compose stack (https://github.com/norseghost/nfr-dckr-cmps). issue still persists
JanHellwig commentedon Apr 14, 2025
I'm experiencing the same since upgrading to Nextcloud 31. Looks similar to what happened until #44685 got fixed last year.
norseghost commentedon Apr 14, 2025
Yes, it does seem similar — except this is specifically about http vs https URL’s. Something seems to get confused when building the route to the app links. I think
FrederikP commentedon Apr 21, 2025
Same here with 31.0.2