directEditing traffic as cleartext

Expected behaviour

Everything as

"CONNECT <nextcloudserver>:443 HTTP/1.1" 200 3940 "-" "Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.9" TCP_TUNNEL:Sh

Actual behaviour

Part of traffic as https connect but few http entries

"GET http://<nextcloudserver>/nextcloud/index.php/apps/files/directEditing/d8BqZ2tqy2RCmQG9BFGJpNTBaqiTfptxxCAQ3DGAzRrRkq5SB9a7z6gmsfZBejXL HTTP/1.1" 301 951 "-" "Mozilla/5.0 (iOS) Nextcloud-iOS/2.25.9" TCP_MISS:Sh

directEditing seems the only page affected

Steps to reproduce

Ipad with Proxy setup (squid) to access nextcloud server

Reasoning or why should it be changed/implemented?

Security issue, cleartext traffic and possible Man-in-the-middle

iOS version

13.5.1

App version

2.25.9

Server configuration

Operating system:

# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 18.04.4 LTS
Release:        18.04
Codename:       bionic
# snap info nextcloud
name:      nextcloud
summary:   Nextcloud Server - A safe home for all your data
publisher: Nextcloud✓
store-url: https://snapcraft.io/nextcloud
contact:   https://github.com/nextcloud/nextcloud-snap
license:   unset
description: |
  Where are your photos and documents? With Nextcloud you pick a server of your choice, at home, in
  a data center or at a provider. And that is where your files will be. Nextcloud runs on that
  server, protecting your data and giving you access from your desktop or mobile devices. Through
  Nextcloud you also access, sync and share your existing data on that FTP drive at school, a
  Dropbox or a NAS you have at home.
commands:
  - nextcloud.disable-https
  - nextcloud.enable-https
  - nextcloud.export
  - nextcloud.import
  - nextcloud.manual-install
  - nextcloud.mysql-client
  - nextcloud.mysqldump
  - nextcloud.occ
services:
  nextcloud.apache:          simple, enabled, active
  nextcloud.mdns-publisher:  simple, enabled, active
  nextcloud.mysql:           simple, enabled, active
  nextcloud.nextcloud-cron:  simple, enabled, active
  nextcloud.nextcloud-fixer: simple, enabled, inactive
  nextcloud.php-fpm:         simple, enabled, active
  nextcloud.redis-server:    simple, enabled, active
  nextcloud.renew-certs:     simple, enabled, active
snap-id:      njObIbGQEaVx1H4nyWxchk1i8opy4h54
tracking:     latest/stable
refresh-date: 9 days ago, at 20:50 UTC
channels:
  latest/stable:    18.0.6snap1               2020-06-11 (21521) 265MB -
[...]

Web server:

• nginx reverse-proxy

 dpkg -l |grep nginx
ii  libnginx-mod-http-echo           1.14.0-0ubuntu1.7                           amd64        Bring echo and more shell style goodies to Nginx
ii  nginx-common                     1.14.0-0ubuntu1.7                           all          small, powerful, scalable web/proxy server - common files
ii  nginx-light                      1.14.0-0ubuntu1.7                           amd64        nginx web/proxy server (basic version)

Database:
from snap

PHP version:
from snap

Nextcloud version: (see Nextcloud admin page)
18.0.6snap1

Start by reproducing the directEditing request using an iPad with a Squid proxy, then inspect the iOS app's handling of that request and the resulting HTTP/HTTPS traffic. Done means directEditing traffic no longer produces cleartext GET entries and matches the expected CONNECT behavior; no source file or test is identified in the report.