github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-08 21:59:09 -05:00
Code Issues 564 Packages Projects Releases 72 Wiki Activity

[GH-ISSUE #2176] Websocket connection to collabora with nextcloud(-aio) throws error 400 #4030

New Issue
Closed
opened 2026-04-20 08:26:24 -05:00 by GiteaMirror · 5 comments
GiteaMirror commented 2026-04-20 08:26:24 -05:00
Owner
Copy Link

Originally created by @Joly0 on GitHub (Dec 28, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2176

Describe the Bug

I have switched a while ago to pangolin and have not noticed issues with collabora in nextcloud until now (though havent used that feature in nextcloud for a while). Just now i noticed, that files like excel or word files dont load and throw this error in nextcloud:

Image

In the dev console i see that it tries to reach an wss:// url pointing to my nextcloud instance but throws a 400 bad request error.

I am not sure, what exactly throws this issue, but i tried it with nginx-proxy-manager and there it works no problem.

Environment

  • OS Type & Version: (e.g., Ubuntu 22.04) Debian 12
  • Pangolin Version: 1.14.1
  • Gerbil Version: 1.3.0
  • Traefik Version: v3.6.4
  • Newt Version: 1.8.1
  • Olm Version: (if applicable)

To Reproduce

Install nextcloud and collabora (perferably with nextcloud-aio).
Create pangolin rule for nextcloud
Create excel file
Try to open that excel file
See errro

Expected Behavior

Should just open the file and correctly work with websocket connections

Originally created by @Joly0 on GitHub (Dec 28, 2025). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2176 ### Describe the Bug I have switched a while ago to pangolin and have not noticed issues with collabora in nextcloud until now (though havent used that feature in nextcloud for a while). Just now i noticed, that files like excel or word files dont load and throw this error in nextcloud: <img width="1874" height="330" alt="Image" src="https://github.com/user-attachments/assets/00c508c8-2588-428e-b91a-390fa4fc7924" /> In the dev console i see that it tries to reach an wss:// url pointing to my nextcloud instance but throws a 400 bad request error. I am not sure, what exactly throws this issue, but i tried it with nginx-proxy-manager and there it works no problem. ### Environment - OS Type & Version: (e.g., Ubuntu 22.04) Debian 12 - Pangolin Version: 1.14.1 - Gerbil Version: 1.3.0 - Traefik Version: v3.6.4 - Newt Version: 1.8.1 - Olm Version: (if applicable) ### To Reproduce Install nextcloud and collabora (perferably with nextcloud-aio). Create pangolin rule for nextcloud Create excel file Try to open that excel file See errro ### Expected Behavior Should just open the file and correctly work with websocket connections
GiteaMirror commented 2026-04-20 08:26:25 -05:00
Author
Owner
Copy Link

@TheDadNerd commented on GitHub (Dec 29, 2025):

This actually came from a traefik update. To fix, add the encodedCharacters section to your traefik config. It should look like it does below.

entryPoints:
  web:
    address: :80
  websecure:
    address: :443
    http:
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedQuestionMark: true
<!-- gh-comment-id:3695380702 --> @TheDadNerd commented on GitHub (Dec 29, 2025): This actually came from a traefik update. To fix, add the encodedCharacters section to your traefik config. It should look like it does below. ``` entryPoints: web: address: :80 websecure: address: :443 http: encodedCharacters: allowEncodedSlash: true allowEncodedQuestionMark: true ```
GiteaMirror commented 2026-04-20 08:26:25 -05:00
Author
Owner
Copy Link

@Joly0 commented on GitHub (Dec 29, 2025):

@TheDadNerd Looks like that worked. Thanks

<!-- gh-comment-id:3695442082 --> @Joly0 commented on GitHub (Dec 29, 2025): @TheDadNerd Looks like that worked. Thanks
GiteaMirror commented 2026-04-20 08:26:26 -05:00
Author
Owner
Copy Link

@oschwartz10612 commented on GitHub (Dec 29, 2025):

Adding this to the default config for the next installer

<!-- gh-comment-id:3696850895 --> @oschwartz10612 commented on GitHub (Dec 29, 2025): Adding this to the default config for the next installer
GiteaMirror commented 2026-04-20 08:26:26 -05:00
Author
Owner
Copy Link

@Yonoesio commented on GitHub (Dec 31, 2025):

I’ve finally found the cause of the issue, and it wasn’t Pangolin after all — it was Traefik.

GitLab’s Web IDE and the simple editor were returning 400 Bad Request whenever they tried to load a file through the API, even though everything worked perfectly when accessing GitLab directly via the server’s local IP.

The problem was that Traefik was blocking or normalizing encoded characters in the URL, specifically %2F (encoded slash) and %3F (encoded question mark). GitLab relies on these encoded characters for paths like:

/api/v4/projects/.../repository/files/<path>/raw?ref=<branch>

Because Traefik was rejecting these requests, the Web IDE couldn’t load any file.

The fix was to explicitly allow encoded slashes and question marks in Traefik:

entryPoints:
  web:
    address: :80
  websecure:
    address: :443
    http:
      encodedCharacters:
        allowEncodedSlash: true
        allowEncodedQuestionMark: true

After applying this configuration, both the Web IDE and the simple editor started working normally again.
Posting this here in case it helps anyone else using Pangolin together with Traefik and GitLab.

<!-- gh-comment-id:3701622038 --> @Yonoesio commented on GitHub (Dec 31, 2025): I’ve finally found the cause of the issue, and it wasn’t Pangolin after all — it was Traefik. GitLab’s Web IDE and the simple editor were returning 400 Bad Request whenever they tried to load a file through the API, even though everything worked perfectly when accessing GitLab directly via the server’s local IP. The problem was that Traefik was blocking or normalizing encoded characters in the URL, specifically %2F (encoded slash) and %3F (encoded question mark). GitLab relies on these encoded characters for paths like: `/api/v4/projects/.../repository/files/<path>/raw?ref=<branch>` Because Traefik was rejecting these requests, the Web IDE couldn’t load any file. The fix was to explicitly allow encoded slashes and question marks in Traefik: ```yaml entryPoints: web: address: :80 websecure: address: :443 http: encodedCharacters: allowEncodedSlash: true allowEncodedQuestionMark: true ``` After applying this configuration, both the Web IDE and the simple editor started working normally again. Posting this here in case it helps anyone else using Pangolin together with Traefik and GitLab.
GiteaMirror commented 2026-04-20 08:26:26 -05:00
Author
Owner
Copy Link

@KusAdama commented on GitHub (Jan 24, 2026):

Now, since Traefik 3.6.7, all are true by default, it's 7x allowEncodedXYZ, not only two.

From the docs: 'It is now up to the users to configure the security hardening of encoded characters.'

So thinking this should be all in and as true(?) by default.
Otherwise users still will be hitting this.
It's not that straightforward to debug, especially if Traefik is not 1:1 compared to the Pangolin.

<!-- gh-comment-id:3794529939 --> @KusAdama commented on GitHub (Jan 24, 2026): Now, since [Traefik 3.6.7](https://doc.traefik.io/traefik/v3.6/migrate/v3/#v367), all are true by default, it's 7x allowEncodedXYZ, not only two. From the docs: '_It is now up to the users to configure the security hardening of encoded characters._' So thinking this should be all in and as true(?) by default. Otherwise users still will be hitting this. It's not that straightforward to debug, especially if Traefik is not 1:1 compared to the Pangolin.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#4030
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?