"Upload to Paperless" action failed when "allow_local_remote_servers" not set

Steps to reproduce

1. Install Paperless-NGX behind Reverse Proxy
2. Install Nextcloud behind Reverse Proxy
3. Install Paperless_Integration App and configure it to use paperless url, e.g. https://paperless.my-domain.com

Expected behaviour

I would expect the file to be uploaded to paperless.

Actual behaviour

After clicking on "Upload to paperless" I get an Error with: "Upload to Paperless" action failed.
There is another bigger error in the network console, that might help a little more:

{
  "stack": "_i@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:227282\nbs@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:238829\nm@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:243511\nEventHandlerNonNull*Ls</<@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:243770\nLs<@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:243099\nYs@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:249991\n_request@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:252829\nrequest@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:251353\ne/<@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:253279\nzo/<@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:221553\nma@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:256514\nexec@https://cloud.my-domain.com/apps/integration_paperless/js/integration_paperless-file_action.js?v=612a2aa0-0:2:261126\nV@https://cloud.my-domain.com/dist/files-main.js?v=612a2aa0-0:1:7038\nonActionClick@https://cloud.my-domain.com/dist/files-main.js?v=612a2aa0-0:1:64490\nclick@https://cloud.my-domain.com/dist/files-main.js?v=612a2aa0-0:1:66226\ncn@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2061192\nn@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2053924\ncn@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2061192\n85471/e.prototype.$emit@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2082420\nonClick@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:3590925\nhandleClick@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2698747\ncn@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2061192\nn@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2053924\n85471/Pr/i._wrapper@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2094096\nEventListener.handleEvent*Pr@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2094122\nkt@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2054211\nRr@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2094503\n_@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2103346\nh@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2102655\nf@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2103103\nh@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2102640\n85471/xi@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2106645\n85471/e.prototype._update@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2082572\na@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2114123\n85471/e.prototype.get@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2064692\ne@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2064605\n85471/Ra.prototype.$mount/<@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2114147\n85471/Ra.prototype.$mount@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2114365\ninit@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2069471\n85471/h/<@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2102250\nh@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2102526\nf@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2103103\nh@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2102640\nf@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2103103\nh@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2102640\nf@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2103103\nh@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2102640\n85471/C/<@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2105373\nC@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2105557\n85471/C/<@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2105082\nC@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2105557\n85471/C/<@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2105082\nC@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2105557\n85471/xi@https://cloud.my-domain.com/dist/core-common.js?v=612a2aa0-0:1:2106693\n",
  "message": "Request failed with status code 500",
  "name": "AxiosError",
  "code": "ERR_BAD_RESPONSE",
  "config": {
    "transitional": {
      "silentJSONParsing": true,
      "forcedJSONParsing": true,
      "clarifyTimeoutError": false
    },
    "adapter": [
      "xhr",
      "http",
      "fetch"
    ],
    "transformRequest": [
      null
    ],
    "transformResponse": [
      null
    ],
    "timeout": 0,
    "xsrfCookieName": "XSRF-TOKEN",
    "xsrfHeaderName": "X-XSRF-TOKEN",
    "maxContentLength": -1,
    "maxBodyLength": -1,
    "env": {},
    "headers": {
      "Accept": "application/json, text/plain, */*",
      "Content-Type": "application/x-www-form-urlencoded",
      "requesttoken": "DALYuxSx/LtHfJFaqvn3mj+PM0moml3PQMUtlbXHcsw=:dFHr8yP0i88CMNNqw6nO3lrecj786Q6tEotO2dKMOLY=",
      "X-Requested-With": "XMLHttpRequest"
    },
    "method": "post",
    "url": "https://cloud.my-domain.com/ocs/v2.php/apps/integration_paperless/upload/173573"
  },
  "request": {},
  "response": {
    "data": {
      "ocs": {
        "meta": {
          "status": "failure",
          "statuscode": 500,
          "message": ""
        },
        "data": null
      }
    },
    "status": 500,
    "statusText": "",
    "headers": {
      "cache-control": "no-cache, no-store, must-revalidate",
      "content-length": "79",
      "content-security-policy": "default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'",
      "content-type": "application/json; charset=utf-8",
      "date": "Fri, 14 Mar 2025 17:15:42 GMT",
      "feature-policy": "autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'",
      "referrer-policy": "no-referrer",
      "server": "nginx",
      "x-content-type-options": "nosniff",
      "x-download-options": "noopen",
      "x-firefox-spdy": "h2",
      "x-frame-options": "SAMEORIGIN",
      "x-permitted-cross-domain-policies": "none",
      "x-request-id": "72xVtKmOmk30ClJe4jNo",
      "x-robots-tag": "noindex, nofollow, noindex, nofollow",
      "x-xss-protection": "1; mode=block"
    },
    "config": {
      "transitional": {
        "silentJSONParsing": true,
        "forcedJSONParsing": true,
        "clarifyTimeoutError": false
      },
      "adapter": [
        "xhr",
        "http",
        "fetch"
      ],
      "transformRequest": [
        null
      ],
      "transformResponse": [
        null
      ],
      "timeout": 0,
      "xsrfCookieName": "XSRF-TOKEN",
      "xsrfHeaderName": "X-XSRF-TOKEN",
      "maxContentLength": -1,
      "maxBodyLength": -1,
      "env": {},
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Content-Type": "application/x-www-form-urlencoded",
        "requesttoken": "DALYuxSx/LtHfJFaqvn3mj+PM0moml3PQMUtlbXHcsw=:dFHr8yP0i88CMNNqw6nO3lrecj786Q6tEotO2dKMOLY=",
        "X-Requested-With": "XMLHttpRequest"
      },
      "method": "post",
      "url": "https://cloud.my-domain.com/ocs/v2.php/apps/integration_paperless/upload/173573"
    },
    "request": {}
  }
}

Server configuration

Web server: Nginx

Database: MySQL

PHP version: 8.3

Nextcloud version: 31.01 (also tested with 30.x)

Other information

When setting the value allow_local_remote_servers the upload works just fine, but as I do not want to enable another security risk for my Nextcloud-Instance, I'd prefer to not set this option. I also tried to set the allow_local_remote_servers just for the paperless app, but that did not solve my problem.

I am absolutely sure that nextcloud is able to communicate with my paperless reverse proxy and is able to resolve the DNS-Name.

There is no log entry in the nextcloud.log File, just the things I posted above.

Start by reproducing the POST request to /ocs/v2.php/apps/integration_paperless/upload/173573 and inspect how the integration handles the Paperless URL when allow_local_remote_servers is unset. The fix is complete when the upload succeeds without enabling that Nextcloud option; use the reported integration_paperless-file_action.js request as the client entry point.